5 - GLSA-201403-04

Executive Summary

Summary
Title	QtCore: Denial of Service

Informations
Name	GLSA-201403-04	First vendor Publication	2014-03-13
Vendor	Gentoo	Last vendor Modification	2014-03-13
Severity (Vendor)	Normal	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

A vulnerability in QXmlSimpleReader class can be used to cause a Denial of Service condition.

Background

The Qt toolkit is a comprehensive C++ application development framework.

Description

A vulnerability in QXmlSimpleReader's XML entity parsing has been discovered.

Impact

A remote attacker could entice a user to open a specially crafted XML file using an application linked against QtCore, possibly resulting in Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All QtCore users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-qt/qtcore-4.8.5-r1"

Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying these packages.

References

[ 1 ] CVE-2013-4549 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4549

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201403-04.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-201403-04.xml

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-20	Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:21006

Oval ID:	oval:org.mitre.oval:def:21006
Title:	USN-2057-1 -- qt4-x11, qtbase-opensource-src vulnerability
Description:	Qt could be made to consume resources and hang if it processed XML data.
Family:	unix	Class:	patch
Reference(s):	USN-2057-1 CVE-2013-4549	Version:	5
Platform(s):	Ubuntu 13.10 Ubuntu 13.04 Ubuntu 12.10 Ubuntu 12.04	Product(s):	qt4-x11 qtbase-opensource-src
Definition Synopsis:
Release section Ubuntu 13.10 is installed Packages match section libqt4-xml DPKG is earlier than 4:4.8.4+dfsg-0ubuntu18.1 AND libqt5xml5 DPKG is earlier than 0:5.0.2+dfsg1-7ubuntu11.1 AND Release section Ubuntu 13.04 is installed Packages match section libqt4-xml DPKG is earlier than 4:4.8.4+dfsg-0ubuntu9.5 AND libqt5xml5 DPKG is earlier than 0:5.0.1+dfsg-0ubuntu4.1 AND Release section Ubuntu 12.10 is installed AND libqt4-xml DPKG is earlier than 4:4.8.3+dfsg-0ubuntu3.2 AND Release section Ubuntu 12.04 is installed AND libqt4-xml DPKG is earlier than 4:4.8.1-0ubuntu4.5

Definition Id: oval:org.mitre.oval:def:25590

Oval ID:	oval:org.mitre.oval:def:25590
Title:	SUSE-SU-2014:0265-1 -- Security update for libQt
Description:	The Qt library was updated to fix a XML entity expansion attack (XXE). (CVE-2013-4549) Security Issue reference: * CVE-2013-4549 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4549 >
Family:	unix	Class:	patch
Reference(s):	SUSE-SU-2014:0265-1 CVE-2013-4549	Version:	3
Platform(s):	SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Desktop 11	Product(s):	libQt
Definition Synopsis:
SUSE Linux Enterprise Server 11 and SUSE Linux Enterprise Desktop 11 release section Operation system section SUSE Linux Enterprise Server 11.x is installed AND SUSE Linux Enterprise Desktop 11.x is installed Packages match section libQtWebKit4 RPM is earlier than 0:4.6.3-5.29.2 AND libqt4 RPM is earlier than 0:4.6.3-5.29.2 AND libqt4-qt3support RPM is earlier than 0:4.6.3-5.29.2 AND libqt4-sql RPM is earlier than 0:4.6.3-5.29.2 AND libqt4-sql-mysql RPM is earlier than 0:4.6.3-5.29.2 AND libqt4-sql-sqlite RPM is earlier than 0:4.6.3-5.29.2 AND libqt4-x11 RPM is earlier than 0:4.6.3-5.29.2 AND libQtWebKit4-32bit RPM is earlier than 0:4.6.3-5.29.2 AND libqt4-32bit RPM is earlier than 0:4.6.3-5.29.2 AND libqt4-qt3support-32bit RPM is earlier than 0:4.6.3-5.29.2 AND libqt4-sql-32bit RPM is earlier than 0:4.6.3-5.29.2 AND libqt4-x11-32bit RPM is earlier than 0:4.6.3-5.29.2 AND SUSE Linux Enterprise Server 11 release section SUSE Linux Enterprise Server 11.x is installed AND qt4-x11-tools RPM is earlier than 0:4.6.3-5.29.2 AND SUSE Linux Enterprise Desktop 11 release section SUSE Linux Enterprise Desktop 11.x is installed Packages match section libqt4-sql-postgresql RPM is earlier than 0:4.6.3-5.29.2 AND libqt4-sql-unixODBC RPM is earlier than 0:4.6.3-5.29.2 AND libqt4-sql-mysql-32bit RPM is earlier than 0:4.6.3-5.29.2 AND libqt4-sql-postgresql-32bit RPM is earlier than 0:4.6.3-5.29.2 AND libqt4-sql-sqlite-32bit RPM is earlier than 0:4.6.3-5.29.2 AND libqt4-sql-unixODBC-32bit RPM is earlier than 0:4.6.3-5.29.2

CPE : Common Platform Enumeration

Type	Description	Count
Application	Qt cpe:2.3:a:qt:qt:5.1.0:-:::::: cpe:2.3:a:qt:qt:5.0.2:::::::* cpe:2.3:a:qt:qt:5.0.1:::::::* cpe:2.3:a:qt:qt:5.0.0:-:::::: cpe:2.3:a:qt:qt:4.8.5:::::::* cpe:2.3:a:qt:qt:4.8.4:::::::* cpe:2.3:a:qt:qt:4.8.3:::::::* cpe:2.3:a:qt:qt:4.8.2:::::::* cpe:2.3:a:qt:qt:4.8.1:::::::* cpe:2.3:a:qt:qt:4.8.0:::::::* cpe:2.3:a:qt:qt:4.7.6:::::::* cpe:2.3:a:qt:qt:4.7.6:rc:::::: cpe:2.3:a:qt:qt:4.7.5:::::::* cpe:2.3:a:qt:qt:4.7.4:::::::* cpe:2.3:a:qt:qt:4.7.3:::::::* cpe:2.3:a:qt:qt:4.7.2:::::::* cpe:2.3:a:qt:qt:4.7.1:::::::* cpe:2.3:a:qt:qt:4.7.0:::::::* cpe:2.3:a:qt:qt:4.6.5:rc:::::: cpe:2.3:a:qt:qt:4.6.5:::::::* cpe:2.3:a:qt:qt:4.6.4:::::::* cpe:2.3:a:qt:qt:4.6.3:::::::* cpe:2.3:a:qt:qt:4.6.2:::::::* cpe:2.3:a:qt:qt:4.6.1:::::::* cpe:2.3:a:qt:qt:4.6.0:rc1:::::: cpe:2.3:a:qt:qt:4.6.0:::::::* cpe:2.3:a:qt:qt:4.5.3:::::::* cpe:2.3:a:qt:qt:4.5.2:::::::* cpe:2.3:a:qt:qt:4.5.1:::::::* cpe:2.3:a:qt:qt:4.5.0:::::::* cpe:2.3:a:qt:qt:4.4.3:::::::* cpe:2.3:a:qt:qt:4.4.2:::::::* cpe:2.3:a:qt:qt:4.4.1:::::::* cpe:2.3:a:qt:qt:4.4.0:::::::* cpe:2.3:a:qt:qt:4.3.5:::::::* cpe:2.3:a:qt:qt:4.3.4:::::::* cpe:2.3:a:qt:qt:4.3.3:::::::* cpe:2.3:a:qt:qt:4.3.2:::::::* cpe:2.3:a:qt:qt:4.3.1:::::::* cpe:2.3:a:qt:qt:4.3.0:::::::* cpe:2.3:a:qt:qt:4.2.3:::::::* cpe:2.3:a:qt:qt:4.2.1:::::::* cpe:2.3:a:qt:qt:4.2.0:::::::* cpe:2.3:a:qt:qt:4.1.5:::::::* cpe:2.3:a:qt:qt:4.1.4:::::::* cpe:2.3:a:qt:qt:4.1.3:::::::* cpe:2.3:a:qt:qt:4.1.2:::::::* cpe:2.3:a:qt:qt:4.1.1:::::::* cpe:2.3:a:qt:qt:4.1.0:::::::* cpe:2.3:a:qt:qt:4.0.1:::::::* cpe:2.3:a:qt:qt:4.0.0:::::::* cpe:2.3:a:qt:qt:3.3.8:::::::* cpe:2.3:a:qt:qt:3.3.6:::::::* cpe:2.3:a:qt:qt:3.3.5:::::::* cpe:2.3:a:qt:qt:3.3.4:::::::* cpe:2.3:a:qt:qt:3.3.3:::::::* cpe:2.3:a:qt:qt:3.3.2:::::::* cpe:2.3:a:qt:qt:3.3.1:::::::* cpe:2.3:a:qt:qt:3.3.0:::::::* cpe:2.3:a:qt:qt:2.0.2:::::::* cpe:2.3:a:qt:qt:2.0.1:::::::* cpe:2.3:a:qt:qt:2.0.0:::::::* cpe:2.3:a:qt:qt:1.45:::::::* cpe:2.3:a:qt:qt:1.44:::::::* cpe:2.3:a:qt:qt:1.43:::::::* cpe:2.3:a:qt:qt:1.42:::::::* cpe:2.3:a:qt:qt:1.41:::::::* cpe:2.3:a:qt:qt:::::::: cpe:2.3:a:qt:qt::::::android::*	69

Nessus® Vulnerability Scanner

Date	Description
2019-01-03	Name : The remote Fedora host is missing a security update. File : fedora_2018-17843a895b.nasl - Type : ACT_GATHER_INFO
2018-06-11	Name : The remote Fedora host is missing a security update. File : fedora_2018-0a0da2f3b7.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-38.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-44.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-79.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-94.nasl - Type : ACT_GATHER_INFO
2014-05-06	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_89709e58d49711e3a3d55453ed2e2b49.nasl - Type : ACT_GATHER_INFO
2014-05-02	Name : The remote Fedora host is missing a security update. File : fedora_2014-5695.nasl - Type : ACT_GATHER_INFO
2014-03-14	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201403-04.nasl - Type : ACT_GATHER_INFO
2014-02-21	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_libQtWebKit-devel-140215.nasl - Type : ACT_GATHER_INFO
2014-01-24	Name : The remote Fedora host is missing a security update. File : fedora_2013-22847.nasl - Type : ACT_GATHER_INFO
2014-01-24	Name : The remote Fedora host is missing a security update. File : fedora_2013-22883.nasl - Type : ACT_GATHER_INFO
2014-01-23	Name : The remote Fedora host is missing a security update. File : fedora_2013-22860.nasl - Type : ACT_GATHER_INFO
2014-01-23	Name : The remote Fedora host is missing a security update. File : fedora_2013-22932.nasl - Type : ACT_GATHER_INFO
2013-12-18	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2057-1.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-03-15 13:21:36	Multiple Updates
2014-03-13 21:19:42	First insertion

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	2
CPE ID(s)	69
Nessus® Exploit(s)	15

	Related
5	CVE-2013-4549
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)

5 - GLSA-201403-04

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU