Most recent entries from all

ALSA-2020:4690 — Moderate: qt5-qtbase and qt5-qtwebsockets security and bug fix update

Affected: AlmaLinux:8: qt5-qtbase-static, AlmaLinux:8: qt5-qttools-static

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.

Security Fix(es):

* qt: XML entity expansion vulnerability (CVE-2015-9541)

* qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore attacker can cause DOS (CVE-2018-21035)

* qt: files placed by attacker can influence the working directory and lead to malicious code execution (CVE-2020-0569)

* qt: files placed by attacker can influence the working directory and lead to malicious code execution (CVE-2020-0570)

* qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS applications (CVE-2020-13962)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2025-04906

EUVD-2026-96454

fkie_cve-2015-9541

Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to CVE-2003-1564.

GHSA-h29v-8cc2-w88r

Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to CVE-2003-1564.

gsd-2015-9541

msrc_CVE-2015-9541 — Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXml…

msrc_CVE-2015-9541

RHSA-2020:4690 — Red Hat Security Advisory: qt5-qtbase and qt5-qtwebsockets security and bug fix update

qt: XML entity expansion vulnerability qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore attacker can cause DOS qt: files placed by attacker can influence the working directory and lead to malicious code execution qt: files placed by attacker can influence the working directory and lead to malicious code execution qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS applications

UBUNTU-CVE-2015-9541

Affected: Ubuntu:14.04:LTS: pyside, Ubuntu:14.04:LTS: qt4-x11, Ubuntu:16.04:LTS: qt4-x11, Ubuntu:Pro:16.04:LTS: qtbase-opensource-src, Ubuntu:16.04:LTS: phantomjs, Ubuntu:16.04:LTS: pyside, Ubuntu:Pro:18.04:LTS: qtbase-opensource-src, Ubuntu:18.04:LTS: phantomjs, Ubuntu:18.04:LTS: pyside, Ubuntu:18.04:LTS: qt4-x11 and 5 more

Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to CVE-2003-1564.