Description
QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qtbase-opensource-src | 5.1.1+dfsg-6 | — |
| Debian 13 | qtbase-opensource-src | 5.1.1+dfsg-6 | — |
| Debian 12 | qtbase-opensource-src | 5.1.1+dfsg-6 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | qt4-x11 | 4:4.8.4+dfsg-0ubuntu20 | — |
| Ubuntu 14.04 LTS | qtbase-opensource-src | 5.0.2+dfsg1-7ubuntu13 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | phantomjs | 1.9.0-1ubuntu0.1~esm1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | qt3 | 3.3.8c-140.6 | openSUSE-SU-2024:10287-1 |
Advisories 1
- openSUSE-SU-2024:10287-1 qt3-3.3.8c-140.6 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- [qt-announce] 20131205 [Announce] Qt Project Security Advisory: XML Entity Expansion Denial of Service mailing-list
- 56166 third-party-advisory
- openSUSE-SU-2014:0173 vendor-advisory
- 56008 third-party-advisory
- openSUSE-SU-2014:0125 vendor-advisory
- https://codereview.qt-project.org/#change%2C71010
- openSUSE-SU-2014:0176 vendor-advisory
- openSUSE-SU-2014:0067 vendor-advisory
- http://blog.qt.digia.com/blog/2014/04/24/qt-4-8-6-released/
- USN-2057-1 vendor-advisory
- https://codereview.qt-project.org/#change%2C71368
- openSUSE-SU-2014:0070 vendor-advisory
- FEDORA-2014-5695 vendor-advisory