CVE-2014-3756 The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service (hang and resource consumption) via a crafted string that is trea...
MediumCVSS 5.0
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service (hang and resource consumption) via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the (1) user or (2) channel name in a Qt dialog, (3) subject common name or (4) email address to the Certificate Wizard, or (5) server name in a tooltip.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mumble(Debian:12) | < 1.2.6-1 | 1.2.6-1 |
| debian/mumble(Debian:13) | < 1.2.6-1 | 1.2.6-1 |
| debian/mumble(Debian:14) | < 1.2.6-1 | 1.2.6-1 |
| mumble | = 1.2.0 | No fix listed |
| mumble | = 1.2.1 | No fix listed |
| mumble | = 1.2.2 | No fix listed |
| mumble | = 1.2.3 | No fix listed |
| mumble | = 1.2.3-rc1 | No fix listed |
| mumble | = 1.2.3-rc2 | No fix listed |
| mumble | = 1.2.3-rc3 | No fix listed |
| mumble | = 1.2.4 | No fix listed |
| mumble | = 1.2.4-beta1 | No fix listed |
| mumble | = 1.2.4-rc1 | No fix listed |
| mumble | = 1.2.5 | No fix listed |
References
- Debian Security Tracker CVE-2014-3756 vendor-advisory
- mumble.info vendor-advisory
- [oss-security] 20140515 Mumble 1.2.6: Mumble-SA-2014-005 and Mumble-SA-2014-006 mailing-list
- [oss-security] 20140514 Re: Mumble 1.2.6: Mumble-SA-2014-005 and Mumble-SA-2014-006 mailing-list
- 67401 vdb-entry
- bugs.debian.org issue-tracking