The version of qt5-qtimageformats installed on the remote host is prior to 5.9.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1679 advisory.

    A flaw was found in libwebp. A heap-based buffer overflow was found in PutLE16(). The highest threat from     this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2018-25011)

    A flaw was found in libwebp in versions before 1.0.1. An unitialized variable is used in function     ReadSymbol. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2018-25014)

    A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function     WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-36328)

    A flaw was found in libwebp. A use-after-free was found due to a thread being killed too early. The     highest threat from this vulnerability is to data confidentiality and integrity as well as system     availability. (CVE-2020-36329)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : qt5-qtimageformats (ALAS-2021-1679)

critical Nessus Plugin ID 151270

Version 1.3