The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4275-1 advisory.

    It was discovered that Qt incorrectly handled certain PPM images. If a user or automated system were     tricked into opening a specially crafted PPM file, a remote attacker could cause Qt to crash, resulting in     a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-19872)

    It was discovered that Qt incorrectly handled certain text files. If a user or automated system were     tricked into opening a specially crafted text file, a remote attacker could cause Qt to crash, resulting     in a denial of service. This issue only affected Ubuntu 19.10. (CVE-2019-18281)

    It was discovered that Qt incorrectly searched for plugins in the current working directory. An attacker     could possibly use this issue to execute arbitrary code. (CVE-2020-0569)

    It was discovered that Qt incorrectly searched for libraries relative to the current working directory. An     attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 19.10.
    (CVE-2020-0570)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-60 (QtCore: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in QtCore. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker could possibly execute arbitrary code with the privileges of       the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

According to the version of the qt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Uncontrolled search path in the QT Library before     5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via     local access.(CVE-2020-0570)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4690 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: XML entity expansion vulnerability (CVE-2015-9541)

    * qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore     attacker can cause DOS (CVE-2018-21035)

    * qt: files placed by attacker can influence the working directory and lead to malicious code execution     (CVE-2020-0569)

    * qt: files placed by attacker can influence the working directory and lead to malicious code execution     (CVE-2020-0570)

    * qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS     applications (CVE-2020-13962)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two security issues were found in the Qt library, which could result in plugins and libraries being loaded from the current working directory, resulting in potential code execution.

在 Qt 库中发现两个安全问题，可导致从当前工作目录加载插件和库，进而可能造成代码执行。

发现 Qt 未能正确处理某些 PPM 图像。如果用户或自动化系统受到诱骗打开特别构建的 PPM 文件，则远程攻击者可造成 Qt 崩溃，从而导致拒绝服务。此问题仅影响 Ubuntu 16.04 LTS 和 Ubuntu 18.04 LTS。(CVE-2018-19872)

发现 Qt 未能正确处理某些文本文件。如果用户或自动化系统受到诱骗打开特别构建的文本文件，则远程攻击者可造成 Qt 崩溃，从而导致拒绝服务。此问题仅影响 Ubuntu 19.10。
(CVE-2019-18281)

发现 Qt 在当前工作目录中未正确搜索插件。攻击者可能利用此问题执行任意代码。(CVE-2020-0569)

发现 Qt 未正确搜索与当前工作目录相关的库。攻击者可能利用此问题执行任意代码。此问题仅影响 Ubuntu 19.10。(CVE-2020-0570)

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

远程主机受到 GLSA-202003-60 中所述漏洞的影响（QtCore：多个漏洞）

    已在 QtCore 中发现多个漏洞。请检查下方引用的 CVE 标识符以了解详细信息。
  影响：

    攻击者可能以进程权限执行任意代码，或者造成拒绝服务情况。
  变通方案：

    目前无任何已知的变通方案。

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2020: 4690 公告中提及的多个漏洞的影响。

  - qt：XML 实体扩展漏洞 (CVE-2015-9541)

  - qt5-qtwebsockets: websocket 实现仅允许有限的帧和消息大小，因此攻击者可造成 DOS (CVE-2018-21035)

  - qt：攻击者放置的文件可影响工作目录，并导致恶意代码执行（CVE-2020-0569、CVE-2020-0570）

  - qt5: 在 OpenSSL 握手过程中，未正确调用 SSL_shutdown()，导致 TLS 应用程序拒绝服务 (CVE-2020-13962)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

ID	名前	製品	ファミリー	公開日	更新日	深刻度
133647	Ubuntu 16.04 LTS / 18.04 LTS : Qt vulnerabilities (USN-4275-1)	Nessus	Ubuntu Local Security Checks	2020/2/12	2025/9/3	high
134968	GLSA-202003-60 : QtCore: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/3/27	2024/3/20	high
142154	EulerOS 2.0 SP8 : qt (EulerOS-SA-2020-2321)	Nessus	Huawei Local Security Checks	2020/11/2	2024/2/13	high
142445	RHEL 8 : qt5-qtbase and qt5-qtwebsockets (RHSA-2020:4690)	Nessus	Red Hat Local Security Checks	2020/11/4	2025/3/20	high
133475	Debian DSA-4617-1 : qtbase-opensource-src - security update	Nessus	Debian Local Security Checks	2020/2/5	2024/3/28	high
133475	Debian DSA-4617-1：qtbase-opensource-src - 安全更新	Nessus	Debian Local Security Checks	2020/2/5	2024/3/28	high
133647	Ubuntu 16.04 LTS / 18.04 LTS：Qt 漏洞 (USN-4275-1)	Nessus	Ubuntu Local Security Checks	2020/2/12	2025/9/3	high
134968	GLSA-202003-60：QtCore：多个漏洞	Nessus	Gentoo Local Security Checks	2020/3/27	2024/3/20	high
142445	RHEL 8：qt5-qtbase 和 qt5-qtwebsockets (RHSA-2020: 4690)	Nessus	Red Hat Local Security Checks	2020/11/4	2025/3/20	high

検出

プラグインの検索

high

high

high

high

high

high

high

high

high