CVE-2013-4549 QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.
MediumCVSS 5.0
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/qtbase-opensource-src(Debian:12) | < 5.1.1+dfsg-6 | 5.1.1+dfsg-6 |
| debian/qtbase-opensource-src(Debian:13) | < 5.1.1+dfsg-6 | 5.1.1+dfsg-6 |
| debian/qtbase-opensource-src(Debian:14) | < 5.1.1+dfsg-6 | 5.1.1+dfsg-6 |
| digia qt | <= 5.1.0 | No fix listed |
| qt | = 5.0.2 | No fix listed |
References
- Debian Security Tracker CVE-2013-4549 vendor-advisory
- blog.qt.digia.com
- FEDORA-2014-5695 vendor-advisory
- openSUSE-SU-2014:0067 vendor-advisory
- openSUSE-SU-2014:0070 vendor-advisory
- openSUSE-SU-2014:0125 vendor-advisory
- openSUSE-SU-2014:0173 vendor-advisory
- openSUSE-SU-2014:0176 vendor-advisory
- [qt-announce] 20131205 [Announce] Qt Project Security Advisory: XML Entity Expansion Denial of Service mailing-list
- 56008 third-party-advisory vendor-advisory
- 56166 third-party-advisory vendor-advisory
- USN-2057-1 vendor-advisory
- codereview.qt-project.org