CVE-2015-3427

Name	CVE-2015-3427
Description	Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4422.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-3258-1
Debian Bugs	783926

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
quassel (PTS)	bullseye	1:0.13.1-5	fixed
	bookworm	1:0.14.0-1	fixed
	sid, trixie	1:0.14.0-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
quassel	source	squeeze	(not affected)
quassel	source	wheezy	(not affected)
quassel	source	jessie	1:0.10.0-2.3+deb8u1	DSA-3258-1
quassel	source	(unstable)	1:0.10.0-2.4		783926

Notes

[wheezy] - quassel <not-affected> (incomplete fix for CVE-2013-4422 not applied)
[squeeze] - quassel <not-affected> (incomplete fix for CVE-2013-4422 not applied)
https://github.com/quassel/quassel/commit/6605882f41331c80f7ac3a6992650a702ec71283
http://quassel-irc.org/node/120