Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated user to potentially enable denial of service via local access.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4690 advisory.

  - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is     mishandled in QXmlStreamReader, a related issue to CVE-2003-1564. (CVE-2015-9541)

  - In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages.
    Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service     (memory consumption). (CVE-2018-21035)

  - Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated     user to potentially enable denial of service via local access. (CVE-2020-0569)

  - Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via local access. (CVE-2020-0570)

  - Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles     OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in     unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1     is not affected, regardless of the Qt version.) (CVE-2020-13962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4025 advisory.

    [5.9.7-4]
    - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution       Resolves: bz#1814740       Resolves: bz#1814685

    [5.9.7-3]
    - Fix multilib issue with qtcore-config.h header file       Resolves: bz#1534528

    - Move libQt5EglFSDeviceIntegration lib into correct subpackage       Resolves: bz#1792680

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4690 advisory.

  - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is     mishandled in QXmlStreamReader, a related issue to CVE-2003-1564. (CVE-2015-9541)

  - In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages.
    Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service     (memory consumption). (CVE-2018-21035)

  - Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated     user to potentially enable denial of service via local access. (CVE-2020-0569)

  - Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via local access. (CVE-2020-0570)

  - Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles     OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in     unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1     is not affected, regardless of the Qt version.) (CVE-2020-13962)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has qt5-qtbase packages installed that are affected by multiple vulnerabilities:

  - Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated     user to potentially enable denial of service via local access. (CVE-2020-0569)

  - Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via local access. (CVE-2020-0570)

  - An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in     gui/image/qxbmhandler.cpp has a buffer over-read. (CVE-2020-17507)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has qt5-qtbase packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in     gui/image/qxbmhandler.cpp has a buffer over-read. (CVE-2020-17507)

  - Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via local access. (CVE-2020-0570)

  - Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated     user to potentially enable denial of service via local access. (CVE-2020-0569)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4690 advisory.

  - qt: XML entity expansion vulnerability (CVE-2015-9541)

  - qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore     attacker can cause DOS (CVE-2018-21035)

  - qt: files placed by attacker can influence the working directory and lead to malicious code execution     (CVE-2020-0569, CVE-2020-0570)

  - qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS     applications (CVE-2020-13962)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4025 advisory.

  - Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated     user to potentially enable denial of service via local access. (CVE-2020-0569)

  - Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via local access. (CVE-2020-0570)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4025 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: files placed by attacker can influence the working directory and lead to malicious code execution     (CVE-2020-0569)

    * qt: files placed by attacker can influence the working directory and lead to malicious code execution     (CVE-2020-0570)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4690 advisory.

    qt5-qtbase     [5.12.5-6]
    - OpenSSL: handle SSL_shutdowns errors properly       Resolves: bz#1851538

    [5.12.5-5]
    - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution       Resolves: bz#1814739       Resolves: bz#1814683

    - Fix: XML entity expansion vulnerability       Resolves: bz#1822193

    qt5-qttools     [5.12.5-2]
    - Rebuild (LLVM-10)       Resolves: bz#1832857

    qt5-qtwebsockets     [5.12.5-2]
    - Add a public api to set max frame and message size       Resolves: bz#1815187

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4690 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: XML entity expansion vulnerability (CVE-2015-9541)

    * qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore     attacker can cause DOS (CVE-2018-21035)

    * qt: files placed by attacker can influence the working directory and lead to malicious code execution     (CVE-2020-0569)

    * qt: files placed by attacker can influence the working directory and lead to malicious code execution     (CVE-2020-0570)

    * qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS     applications (CVE-2020-13962)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1543 advisory.

  - Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via local access. (CVE-2020-0570)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - qt: files placed by attacker can influence the working     directory and lead to malicious code execution     (CVE-2020-0569)

  - qt: files placed by attacker can influence the working     directory and lead to malicious code execution     (CVE-2020-0570)

A wireless network adapter driver on the remote host is affected by multiple security vulnerabilities:
 
 - Insecure inherited permissions in Intel(R) PROSet/Wireless WiFi products    before version 21.70 on Windows 10 may allow an authenticated user to    potentially enable escalation of privilege via local access. (CVE-2020-0557)  
 - Improper buffer restrictions in kernel mode driver for Intel(R)    PROSet/Wireless WiFi products before version 21.70 on Windows 10 may allow    an unprivileged user to potentially enable denial of service via adjacent    access. (CVE-2020-0558)

 - Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows    10 may allow an authenticated user to potentially enable denial of service via    local access. (CVE-2020-0569)   Note that Nessus has not tested for this issue but has instead relied only  on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-60 (QtCore: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in QtCore. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker could possibly execute arbitrary code with the privileges of       the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for libqt5-qtbase fixes the following issues :

Security issue fixed:&#9; 

  - CVE-2020-0569: Fixed a potential local code execution by     loading plugins from CWD (bsc#1161167).

Other issue fixed :

  - Fixed comboboxes not showing in correct location     (bsc#1158667).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4275-1 advisory.

    It was discovered that Qt incorrectly handled certain PPM images. If a user or automated system were     tricked into opening a specially crafted PPM file, a remote attacker could cause Qt to crash, resulting in     a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-19872)

    It was discovered that Qt incorrectly handled certain text files. If a user or automated system were     tricked into opening a specially crafted text file, a remote attacker could cause Qt to crash, resulting     in a denial of service. This issue only affected Ubuntu 19.10. (CVE-2019-18281)

    It was discovered that Qt incorrectly searched for plugins in the current working directory. An attacker     could possibly use this issue to execute arbitrary code. (CVE-2020-0569)

    It was discovered that Qt incorrectly searched for libraries relative to the current working directory. An     attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 19.10.
    (CVE-2020-0570)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libqt5-qtbase fixes the following issues :

CVE-2020-0569: Fixed a potential local code execution by loading plugins from CWD (bsc#1161167).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libqt5-qtbase fixes the following issues :

Security issue fixed :

CVE-2020-0569: Fixed a potential local code execution by loading plugins from CWD (bsc#1161167).

Other issue fixed :

Fixed comboboxes not showing in correct location (bsc#1158667).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libqt5-qtbase fixes the following issue :

Security issues fixed :

CVE-2020-0569: Fixed a potential local code execution by loading plugins from CWD (bsc#1161167).

CVE-2018-19870: Fixed an improper check in QImage allocation which could allow Denial of Service when opening crafted gif files (bsc#1118597).

CVE-2018-19872: Fixed an issue which could allow a division by zero leading to crash (bsc#1130246).

Other issue addressed :

Fixed an issue with rendering animated gifs (QTBUG-55141).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libqt5-qtbase fixes the following issue :

Security issue fixed :

CVE-2020-0569: Fixed a potential local code execution by loading plugins from CWD (bsc#1161167).

CVE-2018-19870: Fixed an improper check in QImage allocation which could allow Denial of Service when opening crafted gif files (bsc#1118597).

CVE-2018-19872: Fixed an issue which could allow a division by zero leading to crash (bsc#1130246).

Other issue addressed :

Fixed an issue with rendering animated gifs (QTBUG-55141).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libqt5-qtbase fixes the following issues :

Security issues fixed :

CVE-2020-0569: Fixed a potential local code execution by loading plugins from CWD (bsc#1161167).

CVE-2018-19870: Fixed an improper check in QImage allocation which could allow Denial of Service when opening crafted gif files (bsc#1118597).

CVE-2018-19872: Fixed an issue which could allow a division by zero leading to crash (bsc#1130246).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two security issues were found in the Qt library, which could result in plugins and libraries being loaded from the current working directory, resulting in potential code execution.

In Qt5's plugin loader code as found in qtbase-opensource-src, it was possible to (side-)load plugins from 'the' local folder in addition to a system-widely defined library path.

For Debian 8 'Jessie', this problem has been fixed in version 5.3.2+dfsg-4+deb8u4.

We recommend that you upgrade your qtbase-opensource-src packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
184835	Rocky Linux 8 : qt5-qtbase and qt5-qtwebsockets (RLSA-2020:4690)	Nessus	Rocky Linux Local Security Checks	high
180969	Oracle Linux 7 : qt5-qtbase (ELSA-2020-4025)	Nessus	Oracle Linux Local Security Checks	high
157637	AlmaLinux 8 : qt5-qtbase and qt5-qtwebsockets (ALSA-2020:4690)	Nessus	Alma Linux Local Security Checks	high
154462	NewStart CGSL CORE 5.05 / MAIN 5.05 : qt5-qtbase Multiple Vulnerabilities (NS-SA-2021-0156)	Nessus	NewStart CGSL Local Security Checks	high
147374	NewStart CGSL CORE 5.04 / MAIN 5.04 : qt5-qtbase Multiple Vulnerabilities (NS-SA-2021-0035)	Nessus	NewStart CGSL Local Security Checks	high
146016	CentOS 8 : qt5-qtbase and qt5-qtwebsockets (CESA-2020:4690)	Nessus	CentOS Local Security Checks	high
143287	CentOS 7 : qt5-qtbase (RHSA-2020:4025)	Nessus	CentOS Local Security Checks	high
143091	RHEL 7 : qt5-qtbase (RHSA-2020:4025)	Nessus	Red Hat Local Security Checks	high
142803	Oracle Linux 8 : qt5-qtbase / and / qt5-qtwebsockets (ELSA-2020-4690)	Nessus	Oracle Linux Local Security Checks	high
142445	RHEL 8 : qt5-qtbase and qt5-qtwebsockets (RHSA-2020:4690)	Nessus	Red Hat Local Security Checks	high
141971	Amazon Linux 2 : qt5-qtbase (ALAS-2020-1543)	Nessus	Amazon Linux Local Security Checks	high
141755	Scientific Linux Security Update : qt5-qtbase on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	high
136670	Intel® PROSet/Wireless WiFi Software x < 21.70.0 Multiple Vulnerabilities	Nessus	Windows	high
134968	GLSA-202003-60 : QtCore: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
133667	openSUSE Security Update : libqt5-qtbase (openSUSE-2020-209)	Nessus	SuSE Local Security Checks	medium
133647	Ubuntu 16.04 LTS / 18.04 LTS : Qt vulnerabilities (USN-4275-1)	Nessus	Ubuntu Local Security Checks	high
133544	SUSE SLED15 / SLES15 Security Update : libqt5-qtbase (SUSE-SU-2020:0349-1)	Nessus	SuSE Local Security Checks	medium
133541	SUSE SLED15 / SLES15 Security Update : libqt5-qtbase (SUSE-SU-2020:0346-1)	Nessus	SuSE Local Security Checks	medium
133495	SUSE SLES12 Security Update : libqt5-qtbase (SUSE-SU-2020:0319-1)	Nessus	SuSE Local Security Checks	high
133494	SUSE SLES12 Security Update : libqt5-qtbase (SUSE-SU-2020:0318-1)	Nessus	SuSE Local Security Checks	high
133493	SUSE SLED12 / SLES12 Security Update : libqt5-qtbase (SUSE-SU-2020:0317-1)	Nessus	SuSE Local Security Checks	high
133475	Debian DSA-4617-1 : qtbase-opensource-src - security update	Nessus	Debian Local Security Checks	high
133412	Debian DLA-2092-1 : qtbase-opensource-src security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-0569

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high

medium

medium

high

high

high

high

medium