CVE-2013-4549

QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:N/A:P
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
VendorProductVersion
digiaqt
𝑥
≤ 5.1.0
qtqt
5.0.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
qtbase-opensource-src
bullseye
5.15.2+dfsg-9+deb11u1
fixed
wheezy
no-dsa
squeeze
no-dsa
bookworm
5.15.8+dfsg-11+deb12u2
fixed
trixie
5.15.13+dfsg-4
fixed
sid
5.15.15+dfsg-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
phantomjs
disco
not-affected
cosmic
not-affected
bionic
not-affected
artful
ignored
zesty
ignored
yakkety
ignored
xenial
not-affected
wily
ignored
vivid
ignored
utopic
ignored
trusty
Fixed 1.9.0-1ubuntu0.1~esm1
released
saucy
ignored
raring
ignored
quantal
ignored
precise
not-affected
lucid
dne
qt4-x11
disco
Fixed 4:4.8.4+dfsg-0ubuntu20
released
cosmic
Fixed 4:4.8.4+dfsg-0ubuntu20
released
bionic
Fixed 4:4.8.4+dfsg-0ubuntu20
released
artful
Fixed 4:4.8.4+dfsg-0ubuntu20
released
zesty
Fixed 4:4.8.4+dfsg-0ubuntu20
released
yakkety
Fixed 4:4.8.4+dfsg-0ubuntu20
released
xenial
Fixed 4:4.8.4+dfsg-0ubuntu20
released
wily
Fixed 4:4.8.4+dfsg-0ubuntu20
released
vivid
Fixed 4:4.8.4+dfsg-0ubuntu20
released
utopic
Fixed 4:4.8.4+dfsg-0ubuntu20
released
trusty
Fixed 4:4.8.4+dfsg-0ubuntu20
released
saucy
Fixed 4:4.8.4+dfsg-0ubuntu18.1
released
raring
Fixed 4:4.8.4+dfsg-0ubuntu9.5
released
quantal
Fixed 4:4.8.3+dfsg-0ubuntu3.2
released
precise
Fixed 4:4.8.1-0ubuntu4.5
released
lucid
ignored
qtbase-opensource-src
disco
Fixed 5.0.2+dfsg1-7ubuntu13
released
cosmic
Fixed 5.0.2+dfsg1-7ubuntu13
released
bionic
Fixed 5.0.2+dfsg1-7ubuntu13
released
artful
Fixed 5.0.2+dfsg1-7ubuntu13
released
zesty
Fixed 5.0.2+dfsg1-7ubuntu13
released
yakkety
Fixed 5.0.2+dfsg1-7ubuntu13
released
xenial
Fixed 5.0.2+dfsg1-7ubuntu13
released
wily
Fixed 5.0.2+dfsg1-7ubuntu13
released
vivid
Fixed 5.0.2+dfsg1-7ubuntu13
released
utopic
Fixed 5.0.2+dfsg1-7ubuntu13
released
trusty
Fixed 5.0.2+dfsg1-7ubuntu13
released
saucy
Fixed 5.0.2+dfsg1-7ubuntu11.1
released
raring
Fixed 5.0.1+dfsg-0ubuntu4.1
released
quantal
dne
precise
dne
lucid
dne
Common Weakness Enumeration
References
http://blog.qt.digia.com/blog/2014/04/24/qt-4-8-6-released/
http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132395.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00044.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00047.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00085.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00104.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00106.html
http://lists.qt-project.org/pipermail/announce/2013-December/000036.html
http://secunia.com/advisories/56008
http://secunia.com/advisories/56166
http://www.ubuntu.com/usn/USN-2057-1
https://codereview.qt-project.org/#change%2C71010
https://codereview.qt-project.org/#change%2C71368
http://blog.qt.digia.com/blog/2014/04/24/qt-4-8-6-released/
http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132395.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00044.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00047.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00085.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00104.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00106.html
http://lists.qt-project.org/pipermail/announce/2013-December/000036.html
http://secunia.com/advisories/56008
http://secunia.com/advisories/56166
http://www.ubuntu.com/usn/USN-2057-1
https://codereview.qt-project.org/#change%2C71010
https://codereview.qt-project.org/#change%2C71368