據發現，Qt 未正確處理某些 PPM 影像。如果使用者或自動化系統遭誘騙而開啟特製的 PPM 檔案，遠端攻擊者可造成 Qt 損毀，從而導致拒絕服務。此問題僅影響了 Ubuntu 16.04 LTS 和 Ubuntu 18.04 LTS。(CVE-2018-19872)

據發現，Qt 未正確處理某些文字檔案。如果使用者或自動化系統遭誘騙而開啟特製的文字檔案，遠端攻擊者可造成 Qt 損毀，從而導致拒絕服務。此問題只會影響 Ubuntu 19.10。
(CVE-2019-18281)

據發現，Qt 未正確搜尋目前工作目錄中的外掛程式。攻擊者可能利用此問題執行任意程式碼。(CVE-2020-0569)

據發現，Qt 未正確搜尋相對於目前工作目錄的程式庫。攻擊者可能利用此問題執行任意程式碼。此問題僅影響了 Ubuntu 19.10。(CVE-2020-0570)。

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

遠端主機受到 GLSA-202003-60 中所述的弱點影響 (QtCore：多個弱點)

    在 QtCore 中發現多個弱點。如需詳細資訊，請檢閱下方提及的 CVE 識別碼。
  影響：

    攻擊者可能以處理程序的權限執行任意程式碼，或造成拒絕服務情形。
  因應措施：

    目前尚無已知的因應措施。

執行 CORE 5.04 / MAIN 5.04 版的遠端 NewStart CGSL 主機上安裝的 qt5-qtbase 套件受到多個弱點影響：

  - 在 Qt 5.12.9 及之前版本，以及 5.13.x 至 5.15.1 之前的 5.15.x 版本中發現一個問題。gui/image/qxbmhandler.cpp 的 read_xbm_body 中存在緩衝區過度讀取問題。(CVE-2020-17507)

  - 在 QT 程式庫 5.14.0、5.12.7 和 5.9.10 之前版本中，不受控制的搜尋路徑可能允許經驗證的使用者透過本機存取權來實現權限提升。(CVE-2020-0570)

  - Windows 10 版 Intel(R) PROSet/無線 WiFi 產品中存在超出邊界寫入問題，經驗證的使用者或可透過本機存取造成拒絕服務。(CVE-2020-0569)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

執行 CORE 5.05 / MAIN 5.05 版的遠端 NewStart CGSL 主機上安裝的 qt5-qtbase 套件受到多個弱點影響：

  - Windows 10 版 Intel(R) PROSet/無線 WiFi 產品中存在超出邊界寫入問題，經驗證的使用者或可透過本機存取造成拒絕服務。(CVE-2020-0569)

  - 在 QT 程式庫 5.14.0、5.12.7 和 5.9.10 之前版本中，不受控制的搜尋路徑可能允許經驗證的使用者透過本機存取權來實現權限提升。(CVE-2020-0570)

  - 在 Qt 5.12.9 及之前版本，以及 5.13.x 至 5.15.1 之前的 5.15.x 版本中發現一個問題。gui/image/qxbmhandler.cpp 的 read_xbm_body 中存在緩衝區過度讀取問題。(CVE-2020-17507)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

遠端主機上安裝的測試產品版本比測試版本舊。因此，會受到 ALAS2-2020-1543 公告中所提及的多個弱點影響。

  - 在 QT 程式庫 5.14.0、5.12.7 和 5.9.10 之前版本中，不受控制的搜尋路徑可能允許經驗證的使用者透過本機存取權來實現權限提升。(CVE-2020-0570)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4690 advisory.

    qt5-qtbase     [5.12.5-6]
    - OpenSSL: handle SSL_shutdowns errors properly       Resolves: bz#1851538

    [5.12.5-5]
    - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution       Resolves: bz#1814739       Resolves: bz#1814683

    - Fix: XML entity expansion vulnerability       Resolves: bz#1822193

    qt5-qttools     [5.12.5-2]
    - Rebuild (LLVM-10)       Resolves: bz#1832857

    qt5-qtwebsockets     [5.12.5-2]
    - Add a public api to set max frame and message size       Resolves: bz#1815187

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the qt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Uncontrolled search path in the QT Library before     5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via     local access.(CVE-2020-0570)

  - An issue was discovered in Qt through 5.12.9, and     5.13.x through 5.15.x before 5.15.1. read_xbm_body in     gui/image/qxbmhandler.cpp has a buffer     over-read.(CVE-2020-17507)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4025 advisory.

  - Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated     user to potentially enable denial of service via local access. (CVE-2020-0569)

  - Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via local access. (CVE-2020-0570)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4690 advisory.

  - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is     mishandled in QXmlStreamReader, a related issue to CVE-2003-1564. (CVE-2015-9541)

  - In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages.
    Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service     (memory consumption). (CVE-2018-21035)

  - Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated     user to potentially enable denial of service via local access. (CVE-2020-0569)

  - Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via local access. (CVE-2020-0570)

  - Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles     OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in     unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1     is not affected, regardless of the Qt version.) (CVE-2020-13962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
133647	Ubuntu 16.04 LTS / 18.04 LTS：Qt 弱點 (USN-4275-1)	Nessus	Ubuntu Local Security Checks	2020/2/12	2024/8/27	high
134968	GLSA-202003-60：QtCore：多個弱點	Nessus	Gentoo Local Security Checks	2020/3/27	2024/3/20	high
147374	NewStart CGSL CORE 5.04 / MAIN 5.04：qt5-qtbase 多個弱點 (NS-SA-2021-0035)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2024/1/11	high
154462	NewStart CGSL CORE 5.05 / MAIN 5.05：qt5-qtbase 多個弱點 (NS-SA-2021-0156)	Nessus	NewStart CGSL Local Security Checks	2021/10/27	2023/11/27	high
141971	Amazon Linux 2：qt5-qtbase (ALAS-2020-1543)	Nessus	Amazon Linux Local Security Checks	2020/10/28	2024/12/11	high
142803	Oracle Linux 8 : qt5-qtbase / and / qt5-qtwebsockets (ELSA-2020-4690)	Nessus	Oracle Linux Local Security Checks	2020/11/12	2024/11/1	high
142327	EulerOS 2.0 SP2 : qt (EulerOS-SA-2020-2393)	Nessus	Huawei Local Security Checks	2020/11/3	2024/2/12	high
143287	CentOS 7 : qt5-qtbase (RHSA-2020:4025)	Nessus	CentOS Local Security Checks	2020/11/30	2024/10/9	high
184835	Rocky Linux 8 : qt5-qtbase and qt5-qtwebsockets (RLSA-2020:4690)	Nessus	Rocky Linux Local Security Checks	2023/11/7	2023/11/7	high

検出

プラグインの検索

high

high

high

high

high

high

high

high

high