Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to CVE-2003-1564.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - qt: segmentation fault in qgifhandler.cpp (CVE-2015-1860)

  - qt: XML entity expansion vulnerability (CVE-2015-9541)

  - The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL     pointer dereference) via invalid width and height values in a GIF image. (CVE-2014-0190)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4690 advisory.

  - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is     mishandled in QXmlStreamReader, a related issue to CVE-2003-1564. (CVE-2015-9541)

  - In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages.
    Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service     (memory consumption). (CVE-2018-21035)

  - Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated     user to potentially enable denial of service via local access. (CVE-2020-0569)

  - Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via local access. (CVE-2020-0570)

  - Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles     OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in     unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1     is not affected, regardless of the Qt version.) (CVE-2020-13962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4690 advisory.

  - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is     mishandled in QXmlStreamReader, a related issue to CVE-2003-1564. (CVE-2015-9541)

  - In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages.
    Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service     (memory consumption). (CVE-2018-21035)

  - Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated     user to potentially enable denial of service via local access. (CVE-2020-0569)

  - Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via local access. (CVE-2020-0570)

  - Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles     OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in     unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1     is not affected, regardless of the Qt version.) (CVE-2020-13962)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4690 advisory.

  - qt: XML entity expansion vulnerability (CVE-2015-9541)

  - qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore     attacker can cause DOS (CVE-2018-21035)

  - qt: files placed by attacker can influence the working directory and lead to malicious code execution     (CVE-2020-0569, CVE-2020-0570)

  - qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS     applications (CVE-2020-13962)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4690 advisory.

    qt5-qtbase     [5.12.5-6]
    - OpenSSL: handle SSL_shutdowns errors properly       Resolves: bz#1851538

    [5.12.5-5]
    - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution       Resolves: bz#1814739       Resolves: bz#1814683

    - Fix: XML entity expansion vulnerability       Resolves: bz#1822193

    qt5-qttools     [5.12.5-2]
    - Rebuild (LLVM-10)       Resolves: bz#1832857

    qt5-qtwebsockets     [5.12.5-2]
    - Add a public api to set max frame and message size       Resolves: bz#1815187

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4690 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: XML entity expansion vulnerability (CVE-2015-9541)

    * qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore     attacker can cause DOS (CVE-2018-21035)

    * qt: files placed by attacker can influence the working directory and lead to malicious code execution     (CVE-2020-0569)

    * qt: files placed by attacker can influence the working directory and lead to malicious code execution     (CVE-2020-0570)

    * qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS     applications (CVE-2020-13962)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the qt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Qt through 5.14 allows an exponential XML entity     expansion attack via a crafted SVG document that is     mishandled in QXmlStreamReader, a related issue to     CVE-2003-1564.(CVE-2015-9541)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2015-9541

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198463	RHEL 7 : qt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
184835	Rocky Linux 8 : qt5-qtbase and qt5-qtwebsockets (RLSA-2020:4690)	Nessus	Rocky Linux Local Security Checks	high
157637	AlmaLinux 8 : qt5-qtbase and qt5-qtwebsockets (ALSA-2020:4690)	Nessus	Alma Linux Local Security Checks	high
146016	CentOS 8 : qt5-qtbase and qt5-qtwebsockets (CESA-2020:4690)	Nessus	CentOS Local Security Checks	high
142803	Oracle Linux 8 : qt5-qtbase / and / qt5-qtwebsockets (ELSA-2020-4690)	Nessus	Oracle Linux Local Security Checks	high
142445	RHEL 8 : qt5-qtbase and qt5-qtwebsockets (RHSA-2020:4690)	Nessus	Red Hat Local Security Checks	high
137511	EulerOS 2.0 SP2 : qt (EulerOS-SA-2020-1669)	Nessus	Huawei Local Security Checks	high
135990	Fedora 31 : qt5-qtbase (2020-3069e44be5)	Nessus	Fedora Local Security Checks	high
135560	EulerOS 2.0 SP3 : qt (EulerOS-SA-2020-1431)	Nessus	Huawei Local Security Checks	high
134814	EulerOS 2.0 SP5 : qt (EulerOS-SA-2020-1323)	Nessus	Huawei Local Security Checks	high
134791	EulerOS 2.0 SP8 : qt (EulerOS-SA-2020-1299)	Nessus	Huawei Local Security Checks	high

Detections

Analytics

CVE-2015-9541

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high