Follow @discotekdotca
CVE-2019-18281
Current Description
An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an application via a text file containing many directional characters.
Basic Data
| Published | October 23, 2019 |
|---|---|
| Last Modified | February 18, 2020 |
| Assigner | cve@mitre.org |
| Data Type | CVE |
| Data Format | MITRE |
| Data Version | 4.0 |
| Problem Type | CWE-119 |
| CVE Data Version | 4.0 |
Base Metric V2
| CVSS 2 - Version | 2.0 |
|---|---|
| CVSS 2 - Vector String | AV:N/AC:M/Au:N/C:N/I:N/A:P |
| CVSS 2 - Access Vector | NETWORK |
| CVSS 2 - Access Complexity | MEDIUM |
| CVSS 2 - Authentication | NONE |
| CVSS 2 - Confidentiality Impact | NONE |
| CVSS 2 - Availability Impact | PARTIAL |
| CVSS 2 - Base Score | 4.3 |
| Severity | MEDIUM |
| Exploitability Score | 8.6 |
| Impact Score | 2.9 |
| Obtain All Privilege | false |
| Obtain User Privilege | false |
| Obtain Other Privilege | false |
Base Metric V3
No data provided.
Configurations
-
OR - Configuration 1
Cpe Version Part Vendor Product Version Update Edition Language SW Edition Target SW Target HW Other Version Start Including Version End Including Version Start Excluding Version End Excluding 2.3 Application Qt Qtbase * * * * * * * * 5.11.0 5.11.3 2.3 Application Qt Qtbase * * * * * * * * 5.12.0 5.12.5 -
OR - Configuration 2
Cpe Version Part Vendor Product Version Update Edition Language SW Edition Target SW Target HW Other Version Start Including Version End Including Version Start Excluding Version End Excluding 2.3 OS Debian Debian Linux 9.0 * * * * * * * 2.3 OS Debian Debian Linux 10.0 * * * * * * *
Vulnerable Software List
| Vendor | Product | Versions |
|---|---|---|
| Debian | Debian Linux | 10.0, 9.0 |
| Qt | Qtbase | * |
References
| Name | Source | URL | Tags |
|---|---|---|---|
| https://bugreports.qt.io/browse/QTBUG-77819 | https://bugreports.qt.io/browse/QTBUG-77819 | MISC | Permissions Required |
| https://bugs.launchpad.net/ubuntu/+source/qtbase-opensource-src/+bug/1848784 | https://bugs.launchpad.net/ubuntu/+source/qtbase-opensource-src/+bug/1848784 | MISC | Issue Tracking Third Party Advisory |
| https://codereview.qt-project.org/c/qt/qtbase/+/271889 | https://codereview.qt-project.org/c/qt/qtbase/+/271889 | MISC | Patch Vendor Advisory |
| 20191104 [SECURITY] [DSA 4556-1] qtbase-opensource-src security update | https://seclists.org/bugtraq/2019/Nov/4 | BUGTRAQ | Mailing List Third Party Advisory |
| GLSA-202003-60 | https://security.gentoo.org/glsa/202003-60 | GENTOO | |
| USN-4275-1 | https://usn.ubuntu.com/4275-1/ | UBUNTU | |
| DSA-4556 | https://www.debian.org/security/2019/dsa-4556 | DEBIAN | Third Party Advisory |