CVE-2018-15518

QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML document.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 83%
VendorProductVersion
qtqt
5.5.0 ≤
𝑥
< 5.11.3
debiandebian_linux
8.0
debiandebian_linux
9.0
opensuseleap
42.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
qtbase-opensource-src
bullseye
5.15.2+dfsg-9+deb11u1
fixed
bookworm
5.15.8+dfsg-11+deb12u2
fixed
sid
5.15.15+dfsg-2
fixed
trixie
5.15.15+dfsg-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
qtbase-opensource-src
disco
Fixed 5.11.3+dfsg-2ubuntu1
released
cosmic
Fixed 5.11.1+dfsg-7ubuntu3.1
released
bionic
Fixed 5.9.5+dfsg-0ubuntu2.1
released
xenial
Fixed 5.5.1+dfsg-16ubuntu7.6
released
trusty
dne
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00066.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00057.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00071.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00073.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00090.html
https://access.redhat.com/errata/RHSA-2019:2135
https://access.redhat.com/errata/RHSA-2019:3390
https://blog.qt.io/blog/2018/12/04/qt-5-11-3-released-important-security-updates/
https://blog.qt.io/blog/2018/12/04/qt-5-11-3-released-important-security-updates/
https://codereview.qt-project.org/#/c/236691/
https://codereview.qt-project.org/#/c/236691/
https://lists.debian.org/debian-lts-announce/2019/01/msg00004.html
https://lists.debian.org/debian-lts-announce/2019/05/msg00014.html
https://lists.debian.org/debian-lts-announce/2020/09/msg00023.html
https://usn.ubuntu.com/4003-1/
https://www.debian.org/security/2019/dsa-4374
http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00066.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00057.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00071.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00073.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00090.html
https://access.redhat.com/errata/RHSA-2019:2135
https://access.redhat.com/errata/RHSA-2019:3390
https://blog.qt.io/blog/2018/12/04/qt-5-11-3-released-important-security-updates/
https://blog.qt.io/blog/2018/12/04/qt-5-11-3-released-important-security-updates/
https://codereview.qt-project.org/#/c/236691/
https://codereview.qt-project.org/#/c/236691/
https://lists.debian.org/debian-lts-announce/2019/01/msg00004.html
https://lists.debian.org/debian-lts-announce/2019/05/msg00014.html
https://lists.debian.org/debian-lts-announce/2020/09/msg00023.html
https://usn.ubuntu.com/4003-1/
https://www.debian.org/security/2019/dsa-4374