Search
Find a vulnerability
Search criteria
4 vulnerabilities found for qtbase by qt
CVE-2023-32762 (GCVE-0-2023-32762)
Vulnerability from nvd – Published: 2023-05-28 00:00 – Updated: 2024-08-19 16:42
VLAI
EPSS
VEX
Summary
An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-01 14:17 UTC
CWE
- n/a
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:37.052Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://codereview.qt-project.org/c/qt/qtbase/+/476140"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/qt/qtbase/commit/1b736a815be0222f4b24289cf17575fc15707305"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.qt-project.org/pipermail/announce/2023-May/000414.html"
},
{
"name": "[debian-lts-announce] 20240430 [SECURITY] [DLA 3805-1] qtbase-opensource-src security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "qtbase",
"vendor": "qt",
"versions": [
{
"lessThan": "5.15.14",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "qtbase",
"vendor": "qt",
"versions": [
{
"lessThan": "6.2.9",
"status": "affected",
"version": "6.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "qtbase",
"vendor": "qt",
"versions": [
{
"lessThan": "6.5.1",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-32762",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-01T14:17:39.605223Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-19T16:42:12.680Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-01T00:06:23.176Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://codereview.qt-project.org/c/qt/qtbase/+/476140"
},
{
"url": "https://github.com/qt/qtbase/commit/1b736a815be0222f4b24289cf17575fc15707305"
},
{
"url": "https://lists.qt-project.org/pipermail/announce/2023-May/000414.html"
},
{
"name": "[debian-lts-announce] 20240430 [SECURITY] [DLA 3805-1] qtbase-opensource-src security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-32762",
"datePublished": "2023-05-28T00:00:00.000Z",
"dateReserved": "2023-05-15T00:00:00.000Z",
"dateUpdated": "2024-08-19T16:42:12.680Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-18281 (GCVE-0-2019-18281)
Vulnerability from nvd – Published: 2019-10-23 14:03 – Updated: 2024-08-05 01:47
VLAI
EPSS
VEX
Summary
An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an application via a text file containing many directional characters.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://bugreports.qt.io/browse/QTBUG-77819 | x_refsource_MISC |
| https://codereview.qt-project.org/c/qt/qtbase/+/271889 | x_refsource_MISC |
| https://bugs.launchpad.net/ubuntu/+source/qtbase-… | x_refsource_MISC |
| https://www.debian.org/security/2019/dsa-4556 | vendor-advisoryx_refsource_DEBIAN |
| https://seclists.org/bugtraq/2019/Nov/4 | mailing-listx_refsource_BUGTRAQ |
| https://usn.ubuntu.com/4275-1/ | vendor-advisoryx_refsource_UBUNTU |
| https://security.gentoo.org/glsa/202003-60 | vendor-advisoryx_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T01:47:14.143Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugreports.qt.io/browse/QTBUG-77819"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://codereview.qt-project.org/c/qt/qtbase/+/271889"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/qtbase-opensource-src/+bug/1848784"
},
{
"name": "DSA-4556",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2019/dsa-4556"
},
{
"name": "20191104 [SECURITY] [DSA 4556-1] qtbase-opensource-src security update",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Nov/4"
},
{
"name": "USN-4275-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/4275-1/"
},
{
"name": "GLSA-202003-60",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202003-60"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an application via a text file containing many directional characters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-26T20:06:03.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugreports.qt.io/browse/QTBUG-77819"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://codereview.qt-project.org/c/qt/qtbase/+/271889"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/qtbase-opensource-src/+bug/1848784"
},
{
"name": "DSA-4556",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2019/dsa-4556"
},
{
"name": "20191104 [SECURITY] [DSA 4556-1] qtbase-opensource-src security update",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "https://seclists.org/bugtraq/2019/Nov/4"
},
{
"name": "USN-4275-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/4275-1/"
},
{
"name": "GLSA-202003-60",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202003-60"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-18281",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an application via a text file containing many directional characters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugreports.qt.io/browse/QTBUG-77819",
"refsource": "MISC",
"url": "https://bugreports.qt.io/browse/QTBUG-77819"
},
{
"name": "https://codereview.qt-project.org/c/qt/qtbase/+/271889",
"refsource": "MISC",
"url": "https://codereview.qt-project.org/c/qt/qtbase/+/271889"
},
{
"name": "https://bugs.launchpad.net/ubuntu/+source/qtbase-opensource-src/+bug/1848784",
"refsource": "MISC",
"url": "https://bugs.launchpad.net/ubuntu/+source/qtbase-opensource-src/+bug/1848784"
},
{
"name": "DSA-4556",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2019/dsa-4556"
},
{
"name": "20191104 [SECURITY] [DSA 4556-1] qtbase-opensource-src security update",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Nov/4"
},
{
"name": "USN-4275-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4275-1/"
},
{
"name": "GLSA-202003-60",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202003-60"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-18281",
"datePublished": "2019-10-23T14:03:53.000Z",
"dateReserved": "2019-10-23T00:00:00.000Z",
"dateUpdated": "2024-08-05T01:47:14.143Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32762 (GCVE-0-2023-32762)
Vulnerability from cvelistv5 – Published: 2023-05-28 00:00 – Updated: 2024-08-19 16:42
VLAI
EPSS
VEX
Summary
An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-01 14:17 UTC
CWE
- n/a
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:37.052Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://codereview.qt-project.org/c/qt/qtbase/+/476140"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/qt/qtbase/commit/1b736a815be0222f4b24289cf17575fc15707305"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.qt-project.org/pipermail/announce/2023-May/000414.html"
},
{
"name": "[debian-lts-announce] 20240430 [SECURITY] [DLA 3805-1] qtbase-opensource-src security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "qtbase",
"vendor": "qt",
"versions": [
{
"lessThan": "5.15.14",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "qtbase",
"vendor": "qt",
"versions": [
{
"lessThan": "6.2.9",
"status": "affected",
"version": "6.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "qtbase",
"vendor": "qt",
"versions": [
{
"lessThan": "6.5.1",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-32762",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-01T14:17:39.605223Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-19T16:42:12.680Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-01T00:06:23.176Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://codereview.qt-project.org/c/qt/qtbase/+/476140"
},
{
"url": "https://github.com/qt/qtbase/commit/1b736a815be0222f4b24289cf17575fc15707305"
},
{
"url": "https://lists.qt-project.org/pipermail/announce/2023-May/000414.html"
},
{
"name": "[debian-lts-announce] 20240430 [SECURITY] [DLA 3805-1] qtbase-opensource-src security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-32762",
"datePublished": "2023-05-28T00:00:00.000Z",
"dateReserved": "2023-05-15T00:00:00.000Z",
"dateUpdated": "2024-08-19T16:42:12.680Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-18281 (GCVE-0-2019-18281)
Vulnerability from cvelistv5 – Published: 2019-10-23 14:03 – Updated: 2024-08-05 01:47
VLAI
EPSS
VEX
Summary
An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an application via a text file containing many directional characters.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://bugreports.qt.io/browse/QTBUG-77819 | x_refsource_MISC |
| https://codereview.qt-project.org/c/qt/qtbase/+/271889 | x_refsource_MISC |
| https://bugs.launchpad.net/ubuntu/+source/qtbase-… | x_refsource_MISC |
| https://www.debian.org/security/2019/dsa-4556 | vendor-advisoryx_refsource_DEBIAN |
| https://seclists.org/bugtraq/2019/Nov/4 | mailing-listx_refsource_BUGTRAQ |
| https://usn.ubuntu.com/4275-1/ | vendor-advisoryx_refsource_UBUNTU |
| https://security.gentoo.org/glsa/202003-60 | vendor-advisoryx_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T01:47:14.143Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugreports.qt.io/browse/QTBUG-77819"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://codereview.qt-project.org/c/qt/qtbase/+/271889"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/qtbase-opensource-src/+bug/1848784"
},
{
"name": "DSA-4556",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2019/dsa-4556"
},
{
"name": "20191104 [SECURITY] [DSA 4556-1] qtbase-opensource-src security update",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Nov/4"
},
{
"name": "USN-4275-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/4275-1/"
},
{
"name": "GLSA-202003-60",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202003-60"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an application via a text file containing many directional characters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-26T20:06:03.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugreports.qt.io/browse/QTBUG-77819"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://codereview.qt-project.org/c/qt/qtbase/+/271889"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/qtbase-opensource-src/+bug/1848784"
},
{
"name": "DSA-4556",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2019/dsa-4556"
},
{
"name": "20191104 [SECURITY] [DSA 4556-1] qtbase-opensource-src security update",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "https://seclists.org/bugtraq/2019/Nov/4"
},
{
"name": "USN-4275-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/4275-1/"
},
{
"name": "GLSA-202003-60",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202003-60"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-18281",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an application via a text file containing many directional characters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugreports.qt.io/browse/QTBUG-77819",
"refsource": "MISC",
"url": "https://bugreports.qt.io/browse/QTBUG-77819"
},
{
"name": "https://codereview.qt-project.org/c/qt/qtbase/+/271889",
"refsource": "MISC",
"url": "https://codereview.qt-project.org/c/qt/qtbase/+/271889"
},
{
"name": "https://bugs.launchpad.net/ubuntu/+source/qtbase-opensource-src/+bug/1848784",
"refsource": "MISC",
"url": "https://bugs.launchpad.net/ubuntu/+source/qtbase-opensource-src/+bug/1848784"
},
{
"name": "DSA-4556",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2019/dsa-4556"
},
{
"name": "20191104 [SECURITY] [DSA 4556-1] qtbase-opensource-src security update",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Nov/4"
},
{
"name": "USN-4275-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4275-1/"
},
{
"name": "GLSA-202003-60",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202003-60"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-18281",
"datePublished": "2019-10-23T14:03:53.000Z",
"dateReserved": "2019-10-23T00:00:00.000Z",
"dateUpdated": "2024-08-05T01:47:14.143Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}