CVE-2014-3755 The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers to cause a denial of service (hang and resource consumption) via a local file reference in an (1) image....
MediumCVSS 5.0
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers to cause a denial of service (hang and resource consumption) via a local file reference in an (1) image tag or (2) XML stylesheet in an SVG file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mumble(Debian:12) | < 1.2.6-1 | 1.2.6-1 |
| debian/mumble(Debian:13) | < 1.2.6-1 | 1.2.6-1 |
| debian/mumble(Debian:14) | < 1.2.6-1 | 1.2.6-1 |
| mumble | <= 1.2.5 | No fix listed |
| mumble | = 1.2.0 | No fix listed |
| mumble | = 1.2.1 | No fix listed |
| mumble | = 1.2.2 | No fix listed |
| mumble | = 1.2.3 | No fix listed |
| mumble | = 1.2.3-rc1 | No fix listed |
| mumble | = 1.2.3-rc2 | No fix listed |
| mumble | = 1.2.3-rc3 | No fix listed |
| mumble | = 1.2.4 | No fix listed |
| mumble | = 1.2.4-beta1 | No fix listed |
| mumble | = 1.2.4-rc1 | No fix listed |
References
- Debian Security Tracker CVE-2014-3755 vendor-advisory
- mumble.info vendor-advisory
- [oss-security] 20140515 Mumble 1.2.6: Mumble-SA-2014-005 and Mumble-SA-2014-006 mailing-list
- [oss-security] 20140514 Re: Mumble 1.2.6: Mumble-SA-2014-005 and Mumble-SA-2014-006 mailing-list
- 67400 vdb-entry
- qt.gitorious.org exploit
- bugs.debian.org issue-tracking