CVE-2020-17507

An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. readxbmbody in gui/image/qxbmhandler.cpp has a buffer over-read.

References

Affected packages

Git / github.com/qt/qtbase

Affected ranges

Type

GIT

Repo

https://github.com/qt/qtbase

Events

Introduced

Last affected

823ed71e220ebde07970dd61c04bb47b01dd06c4

Introduced

fc9ae22c88dd085c7c31599037132fc756feeb04

Fixed

e4961b35deb202525d4711dbb14f8c2bb0bf5c26

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.12.9"
        },
        {
            "introduced": "5.13.0"
        },
        {
            "fixed": "5.15.1"
        }
    ]
}

Affected versions

qt-v5.*

qt-v5.0.0-alpha1

v5.*

v5.0.0

v5.0.0-beta1

v5.0.0-beta2

v5.0.0-rc1

v5.0.0-rc2

v5.0.1

v5.0.2

v5.1.0

v5.1.0-alpha1

v5.1.0-beta1

v5.1.0-rc1

v5.1.0-rc2

v5.1.1

v5.10.0

v5.10.0-alpha1

v5.10.0-beta1

v5.10.0-beta2

v5.10.0-beta3

v5.10.0-beta4

v5.10.0-rc1

v5.10.0-rc2

v5.10.0-rc3

v5.10.1

v5.11.0

v5.11.0-alpha1

v5.11.0-beta1

v5.11.0-beta2

v5.11.0-beta3

v5.11.0-beta4

v5.11.0-rc1

v5.11.0-rc2

v5.11.1

v5.11.2

v5.11.3

v5.12.0

v5.12.0-alpha1

v5.12.0-beta1

v5.12.0-beta2

v5.12.0-beta3

v5.12.0-beta4

v5.12.0-rc1

v5.12.0-rc2

v5.12.1

v5.12.2

v5.12.3

v5.12.4

v5.12.5

v5.12.6

v5.12.7

v5.12.8

v5.12.9

v5.13.0

v5.13.0-alpha1

v5.13.0-beta1

v5.13.0-beta2

v5.13.0-beta3

v5.13.0-beta4

v5.13.0-rc1

v5.13.0-rc2

v5.13.0-rc3

v5.13.1

v5.13.2

v5.14.0

v5.14.0-alpha1

v5.14.0-beta1

v5.14.0-beta2

v5.14.0-beta3

v5.14.0-rc1

v5.14.0-rc2

v5.14.1

v5.14.2

v5.15.0

v5.15.0-alpha1

v5.15.0-beta1

v5.15.0-beta2

v5.15.0-beta3

v5.15.0-beta4

v5.15.0-rc1

v5.15.0-rc2

v5.15.10-lts-lgpl

v5.15.11-lts-lgpl

v5.15.12-lts-lgpl

v5.15.13-lts-lgpl

v5.15.14-lts-lgpl

v5.15.15-lts-lgpl

v5.15.16-lts-lgpl

v5.15.17-lts-lgpl

v5.15.18-lts-lgpl

v5.15.2

v5.15.3-lts-lgpl

v5.15.4-lts-lgpl

v5.15.5-lts-lgpl

v5.15.6-lts-lgpl

v5.15.7-lts-lgpl

v5.15.8-lts-lgpl

v5.15.9-lts-lgpl

v5.2.0

v5.2.0-alpha1

v5.2.0-beta1

v5.2.0-rc1

v5.2.1

v5.3.0

v5.3.0-alpha1

v5.3.0-beta1

v5.3.0-rc1

v5.3.1

v5.3.2

v5.4.0

v5.4.0-alpha1

v5.4.0-beta1

v5.4.0-rc1

v5.4.1

v5.4.2

v5.5.0

v5.5.0-alpha1

v5.5.0-beta1

v5.5.0-rc1

v5.5.1

v5.6.0

v5.6.0-alpha1

v5.6.0-beta1

v5.6.0-rc1

v5.6.1

v5.6.1-1

v5.6.2

v5.6.3

v5.7.0

v5.7.0-alpha1

v5.7.0-beta1

v5.7.0-rc1

v5.7.1

v5.8.0

v5.8.0-alpha1

v5.8.0-beta1

v5.8.0-rc1

v5.9.0

v5.9.0-alpha1

v5.9.0-beta1

v5.9.0-beta2

v5.9.0-beta3

v5.9.0-beta4

v5.9.0-rc1

v5.9.0-rc2

v5.9.1

v5.9.2

v5.9.3

v5.9.4

v5.9.5

v5.9.6

v5.9.7

v5.9.8

v5.9.9

v6.*

v6.0.0

v6.0.0-alpha1

v6.0.0-beta1

v6.0.0-beta2

v6.0.0-beta3

v6.0.0-beta4

v6.0.0-beta5

v6.0.0-rc1

v6.0.0-rc2

v6.0.1

v6.0.2

v6.0.3

v6.0.4

v6.1.0

v6.1.0-alpha1

v6.1.0-beta1

v6.1.0-beta2

v6.1.0-beta3

v6.1.0-rc1

v6.1.0-rc2

v6.1.1

v6.1.2

v6.1.3

v6.10.0

v6.10.0-beta1

v6.10.0-beta2

v6.10.0-beta3

v6.10.0-beta4

v6.10.0-rc1

v6.10.1

v6.10.2

v6.11.0

v6.11.0-beta1

v6.11.0-beta2

v6.11.0-beta3

v6.11.0-rc1

v6.2.0

v6.2.0-alpha1

v6.2.0-beta1

v6.2.0-beta2

v6.2.0-beta3

v6.2.0-beta4

v6.2.0-rc1

v6.2.0-rc2

v6.2.1

v6.2.10-lts-lgpl

v6.2.11-lts-lgpl

v6.2.12-lts-lgpl

v6.2.13-lts-lgpl

v6.2.2

v6.2.3

v6.2.4

v6.2.5-lts-lgpl

v6.2.6-lts-lgpl

v6.2.7-lts-lgpl

v6.2.8-lts-lgpl

v6.2.9-lts-lgpl

v6.3.0

v6.3.0-alpha1

v6.3.0-beta1

v6.3.0-beta2

v6.3.0-beta3

v6.3.0-rc1

v6.3.1

v6.3.2

v6.4.0

v6.4.0-beta1

v6.4.0-beta2

v6.4.0-beta3

v6.4.0-beta4

v6.4.0-rc1

v6.4.1

v6.4.2

v6.4.3

v6.5.0

v6.5.0-beta1

v6.5.0-beta2

v6.5.0-beta3

v6.5.0-rc1

v6.5.1

v6.5.2

v6.5.3

v6.5.4-lts-lgpl

v6.5.5-lts-lgpl

v6.5.6-lts-lgpl

v6.5.7-lts-lgpl

v6.5.8-lts-lgpl

v6.6.0

v6.6.0-beta1

v6.6.0-beta2

v6.6.0-beta3

v6.6.0-beta4

v6.6.0-rc1

v6.6.1

v6.6.2

v6.6.3

v6.7.0

v6.7.0-beta1

v6.7.0-beta2

v6.7.0-beta3

v6.7.0-rc1

v6.7.0-rc2

v6.7.1

v6.7.2

v6.7.3

v6.8.0

v6.8.0-beta1

v6.8.0-beta2

v6.8.0-beta3

v6.8.0-beta4

v6.8.0-rc1

v6.8.1

v6.8.2

v6.8.3

v6.9.0

v6.9.0-beta1

v6.9.0-beta2

v6.9.0-beta3

v6.9.0-rc1

v6.9.1

v6.9.2

v6.9.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-17507.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "31"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "32"
            }
        ]
    }
]

vanir_signatures

[
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "242641743284928064626071892920657218794",
                "106416120088075135311219627565149925684",
                "6689681501335192734927767907587321295",
                "249325656759426096807140923297702562064"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/qt/qtbase/commit/e4961b35deb202525d4711dbb14f8c2bb0bf5c26",
        "id": "CVE-2020-17507-edb2cdac",
        "target": {
            "file": "src/corelib/tools/qvector.h"
        }
    }
]