Qt up to 5.12.9/5.15.0 qxbmhandler.cpp read_xbm_body buffer overflow

Summaryinfo

A vulnerability classified as critical has been found in Qt up to 5.12.9/5.15.0. The affected element is the function read_xbm_body of the file gui/image/qxbmhandler.cpp. This manipulation causes buffer overflow. This vulnerability is handled as CVE-2020-17507. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Qt up to 5.12.9/5.15.0 and classified as critical. Affected by this vulnerability is the function read_xbm_body of the file gui/image/qxbmhandler.cpp. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buffer over-read.

The weakness was released 08/12/2020. This vulnerability is known as CVE-2020-17507 since 08/12/2020. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 301536 (Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Qt vulnerabilities (USN-8076-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.12.10 or 5.15.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (301536) and CERT Bund (WID-SEC-2026-0617). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Open Source CentOS
• Red Hat Enterprise Linux
• Open Source QT
• Ubuntu Linux
• F5 BIG-IP
• SUSE Linux
• Oracle Linux

Productinfo

Name

• Qt

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9
• 5.10
• 5.11
• 5.12
• 5.12.0
• 5.12.1
• 5.12.2
• 5.12.3
• 5.12.4
• 5.12.5
• 5.12.6
• 5.12.7
• 5.12.8
• 5.12.9
• 5.13
• 5.14
• 5.15.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion