Out-of-bounds read in qt5-qtbase - CVE-2020-17507

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU46199

Out-of-bounds read in qt5-qtbase - CVE-2020-17507

Published: August 12, 2020 / Updated: September 1, 2020


Vulnerability identifier: #VU46199
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-17507
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to buffer over-read. A remote attacker can perform a denial of service attack.


Affected software

qt5-qtbase
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
CentOS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for ARM 64
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
SUSE Linux Enterprise Server
SUSE Linux Enterprise Workstation Extension
SUSE Linux Enterprise Software Development Kit
SUSE Linux
Opensuse
Ubuntu
Fedora
BIG-IP
qt5-qtbase (Red Hat package)
qt5-qtbase (Alpine package)
libqt4-qt3support
libqt4-sql-unixODBC-debuginfo
libqt4-devel
libqt4-devel-debuginfo
libqt4-qt3support-32bit
libqt4-32bit
libqt4-linguist
libqt4-linguist-debuginfo
libqt4-private-headers-devel
libqt4
libqt4-debuginfo
libqt4-qt3support-debuginfo
libqt4-sql
libqt4-sql-debuginfo
libqt4-sql-mysql
libqt4-sql-mysql-debuginfo
libqt4-sql-sqlite
libqt4-sql-sqlite-debuginfo
libqt4-x11
libqt4-x11-debuginfo
libqt4-sql-postgresql-32bit
libqt4-x11-32bit
libqt4-sql-debuginfo-32bit
libqt4-sql-32bit
libqt4-qt3support-debuginfo-32bit
libqt4-x11-debuginfo-32bit
libqt4-debuginfo-32bit
libqt4-debugsource
libqt4-sql-mysql-32bit
libqt4-sql-mysql-debuginfo-32bit
libqt4-sql-plugins-debugsource
libqt4-sql-unixODBC-debuginfo-32bit
libqt4-sql-postgresql
libqt4-sql-postgresql-debuginfo-32bit
libqt4-sql-postgresql-debuginfo
libqt4-sql-sqlite-32bit
libqt4-sql-sqlite-debuginfo-32bit
libqt4-sql-unixODBC-32bit
libqt4-sql-unixODBC
qt4-x11-tools
qt4-x11-tools-debuginfo
libqt4-devel-doc-debuginfo
libqt4-devel-doc-data
libqt4-devel-doc-debugsource
libqt4-devel-doc
qt (Red Hat package)
qt
qtbase-opensource-src (Ubuntu package)
libqt5core5a (Ubuntu package)
libqt5gui5 (Ubuntu package)
BIG-IQ Centralized Management

How to mitigate CVE-2020-17507

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

qt5-qtbase (Red Hat package) - addressed in versions 5.9.7-5.el7_9, 5.12.5-8.el8
qt5-qtbase (Alpine package) - update to 5.15.0-r2
libqt4-qt3support - update to 4.8.7-8.16.1
libqt4-sql-unixODBC-debuginfo - update to 4.8.7-8.16.1
libqt4-devel - update to 4.8.7-8.16.1
libqt4-devel-debuginfo - update to 4.8.7-8.16.1
libqt4-qt3support-32bit - update to 4.8.7-8.16.1
libqt4-32bit - update to 4.8.7-8.16.1
libqt4-linguist - update to 4.8.7-8.16.1
libqt4-linguist-debuginfo - update to 4.8.7-8.16.1
libqt4-private-headers-devel - update to 4.8.7-8.16.1
libqt4 - update to 4.8.7-8.16.1
libqt4-debuginfo - update to 4.8.7-8.16.1
libqt4-qt3support-debuginfo - update to 4.8.7-8.16.1
libqt4-sql - update to 4.8.7-8.16.1
libqt4-sql-debuginfo - update to 4.8.7-8.16.1
libqt4-sql-mysql - update to 4.8.7-8.16.1
libqt4-sql-mysql-debuginfo - update to 4.8.7-8.16.1
libqt4-sql-sqlite - update to 4.8.7-8.16.1
libqt4-sql-sqlite-debuginfo - update to 4.8.7-8.16.1
libqt4-x11 - update to 4.8.7-8.16.1
libqt4-x11-debuginfo - update to 4.8.7-8.16.1
libqt4-sql-postgresql-32bit - update to 4.8.7-8.16.1
libqt4-x11-32bit - update to 4.8.7-8.16.1
libqt4-sql-debuginfo-32bit - update to 4.8.7-8.16.1
libqt4-sql-32bit - update to 4.8.7-8.16.1
libqt4-qt3support-debuginfo-32bit - update to 4.8.7-8.16.1
libqt4-x11-debuginfo-32bit - update to 4.8.7-8.16.1
libqt4-debuginfo-32bit - update to 4.8.7-8.16.1
libqt4-debugsource - update to 4.8.7-8.16.1
libqt4-sql-mysql-32bit - update to 4.8.7-8.16.1
libqt4-sql-mysql-debuginfo-32bit - update to 4.8.7-8.16.1
libqt4-sql-plugins-debugsource - update to 4.8.7-8.16.1
libqt4-sql-unixODBC-debuginfo-32bit - update to 4.8.7-8.16.1
libqt4-sql-postgresql - update to 4.8.7-8.16.1
libqt4-sql-postgresql-debuginfo-32bit - update to 4.8.7-8.16.1
libqt4-sql-postgresql-debuginfo - update to 4.8.7-8.16.1
libqt4-sql-sqlite-32bit - update to 4.8.7-8.16.1
libqt4-sql-sqlite-debuginfo-32bit - update to 4.8.7-8.16.1
libqt4-sql-unixODBC-32bit - update to 4.8.7-8.16.1
libqt4-sql-unixODBC - update to 4.8.7-8.16.1
qt4-x11-tools - update to 4.8.7-8.16.2
qt4-x11-tools-debuginfo - update to 4.8.7-8.16.2
libqt4-devel-doc-debuginfo - update to 4.8.7-8.16.2
libqt4-devel-doc-data - update to 4.8.7-8.16.2
libqt4-devel-doc-debugsource - update to 4.8.7-8.16.2
libqt4-devel-doc - update to 4.8.7-8.16.2
qt (Red Hat package) - update to 4.8.7-9.el7_9
qt - addressed in versions 4.8.7-55.fc31, 4.8.7-55.fc32
qtbase-opensource-src (Ubuntu package) - addressed in versions 5.5.1+dfsg-16ubuntu7.7+esm2, 5.9.5+dfsg-0ubuntu2.6+esm2, 5.12.8+dfsg-0ubuntu2.1+esm3, 5.15.3+dfsg-2ubuntu0.2+esm3, 5.15.13+dfsg-1ubuntu1+esm1
libqt5core5a (Ubuntu package) - update to 5.9.5+dfsg-0ubuntu2.6
libqt5gui5 (Ubuntu package) - update to 5.9.5+dfsg-0ubuntu2.6

External References

Related Security Bulletins