Lucene search
Veracode Vulnerability DatabaseVERACODE:27804HistoryNov 05, 2020 - 3:17 a.m.
XML Entity Expansion (XEE)
2020-11-0503:17:49
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
14
xml entity expansion
qt
qxmlstreamreader
svg
xml bomb attack
EPSS
0.003
Percentile
65.1%
Qt is is vulnerable to XML entity expansion. The vulnerability exists due to mishandling of ‘QXmlStreamReader’ allowing a malicious attacker to send crafted SVG to cause an xml bomb attack.
References
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/
access.redhat.com/errata/RHSA-2020:4690
access.redhat.com/security/updates/classification/#moderate
bugreports.qt.io/browse/QTBUG-47417
lists.fedoraproject.org/archives/list/[email protected]/message/2PT6327C64Q4RBFRWUSBKCG7SVGBWU5W/
lists.fedoraproject.org/archives/list/[email protected]/message/EZMMF4OEJAZRVKVXNO7IZWLEZVQGJN6G/
Related
openvas
openvas
Fedora: Security Advisory for qt5-qtbase (FEDORA-2020-ca02c529f8)
2020-04-30 00:00:00
Fedora: Security Advisory for qt5-qtbase (FEDORA-2020-3069e44be5)
2020-04-30 00:00:00
Mageia: Security Advisory (MGASA-2020-0192)
2022-01-28 00:00:00
cbl_mariner
cbl_mariner
CVE-2015-9541 affecting package qt5-qtsvg for versions less than 5.12.11-3
2022-04-26 19:57:36
CVE-2015-9541 affecting package qt5-qtbase 5.12.5-5
2021-08-12 21:14:37
mageia
mageia
Updated qtbase5 packages fix security vulnerability
2020-05-05 15:20:37
fedora
fedora
[SECURITY] Fedora 31 Update: qt5-qtbase-5.13.2-3.fc31
2020-04-25 03:02:30
[SECURITY] Fedora 32 Update: qt5-qtbase-5.13.2-5.fc32
2020-04-25 02:32:19
nessus
nessus
Fedora 31 : qt5-qtbase (2020-3069e44be5)
2020-04-27 00:00:00
EulerOS 2.0 SP8 : qt (EulerOS-SA-2020-1299)
2020-03-23 00:00:00
EulerOS 2.0 SP2 : qt (EulerOS-SA-2020-1669)
2020-06-17 00:00:00
debiancve
debiancve
CVE-2015-9541
2020-01-24 22:15:12
prion
prion
Design/Logic Flaw
2020-01-24 22:15:00
nvd
nvd
CVE-2015-9541
2020-01-24 22:15:12
ubuntucve
ubuntucve
CVE-2015-9541
2020-01-24 00:00:00
cve
cve
CVE-2015-9541
2020-01-24 22:15:12
cvelist
cvelist
CVE-2015-9541
2020-01-24 21:53:41
rocky
rocky
qt5-qtbase and qt5-qtwebsockets security and bug fix update
2020-11-03 12:27:18
oraclelinux
oraclelinux
qt5-qtbase and qt5-qtwebsockets security and bug fix update
2020-11-10 00:00:00
osv
osv
Moderate: qt5-qtbase and qt5-qtwebsockets security and bug fix update
2020-11-03 12:27:18
Moderate: qt5-qtbase and qt5-qtwebsockets security and bug fix update
2020-11-03 12:27:18
almalinux
almalinux
Moderate: qt5-qtbase and qt5-qtwebsockets security and bug fix update
2020-11-03 12:27:18
redhat
redhat