Veracode Vulnerability DatabaseVERACODE:27804XML Entity Expansion (XEE)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
Qt is is vulnerable to XML entity expansion. The vulnerability exists due to mishandling of ‘QXmlStreamReader’ allowing a malicious attacker to send crafted SVG to cause an xml bomb attack.
References
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/
access.redhat.com/errata/RHSA-2020:4690
access.redhat.com/security/updates/classification/#moderate
bugreports.qt.io/browse/QTBUG-47417
lists.fedoraproject.org/archives/list/[email protected]/message/2PT6327C64Q4RBFRWUSBKCG7SVGBWU5W/
lists.fedoraproject.org/archives/list/[email protected]/message/EZMMF4OEJAZRVKVXNO7IZWLEZVQGJN6G/
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P