The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3539 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3539-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                  Roberto C. Snchez     August 22, 2023                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : qt4-x11     Version        : 4:4.8.7+dfsg-18+deb10u2     CVE ID         : CVE-2021-3481 CVE-2021-45930 CVE-2023-32573 CVE-2023-32763                      CVE-2023-34410 CVE-2023-37369 CVE-2023-38197

    Several vulnerabilities have been found in qt4-x11, a graphical     windowing toolkit.

    CVE-2021-3481

        While rendering and displaying a crafted Scalable Vector Graphics         (SVG) file this flaw may lead to an unauthorized memory access. The         highest threat from this vulnerability is to data confidentiality         and the application availability.

    CVE-2021-45930

        An out-of-bounds write in         QtPrivate::QCommonArrayOps<QPainterPath::Element>::growAppend         (called from QPainterPath::addPath and QPathClipper::intersect).

    CVE-2023-32573

        Uninitialized variable usage in m_unitsPerEm.

    CVE-2023-32763

        An application crash in QXmlStreamReader via a crafted XML string         that triggers a situation in which a prefix is greater than a         length.

    CVE-2023-34410

        Certificate validation for TLS does not always consider whether the         root of a chain is a configured CA certificate.

    CVE-2023-37369

        There can be an application crash in QXmlStreamReader via a crafted         XML string that triggers a situation in which a prefix is greater         than a length.

    CVE-2023-38197

        There are infinite loops in recursive entity expansion.

    For Debian 10 buster, these problems have been fixed in version     4:4.8.7+dfsg-18+deb10u2.

    We recommend that you upgrade your qt4-x11 packages.

    For the detailed security status of qt4-x11 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/qt4-x11

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3539 : libqt4-dbg - security update

high Nessus Plugin ID 180039

Version 1.1

Version 1.0

Version 1.1 Jan 22, 2025, 3:03 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501221503
Version 1.0 Aug 23, 2023, 8:04 AM New Plugin Feed: 202308230804