UBUNTU-CVE-2020-36632

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2020-36632

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-36632.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2020-36632

Upstream

CVE-2020-36632

Published

2022-12-25T20:15:00Z

Modified

2025-10-10T15:00:29Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to initiate the attack remotely. Upgrading to version 5.0.1 is able to address this issue. The name of the patch is 20ef0ef55dfa028caddaedbcb33efbdb04d18e13. It is recommended to upgrade the affected component. The identifier VDB-216777 was assigned to this vulnerability.

References

Affected packages

Ubuntu:22.04:LTS / qt6-webengine

Package

Name: qt6-webengine
Purl: pkg:deb/ubuntu/qt6-webengine@6.2.4+dfsg-6ubuntu1?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.2.2+dfsg-6ubuntu2

6.2.4+dfsg-1ubuntu1

6.2.4+dfsg-1ubuntu2

6.2.4+dfsg-6ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libqt6pdf6",
            "binary_version": "6.2.4+dfsg-6ubuntu1"
        },
        {
            "binary_name": "libqt6pdfquick6",
            "binary_version": "6.2.4+dfsg-6ubuntu1"
        },
        {
            "binary_name": "libqt6pdfwidgets6",
            "binary_version": "6.2.4+dfsg-6ubuntu1"
        },
        {
            "binary_name": "libqt6webengine6-data",
            "binary_version": "6.2.4+dfsg-6ubuntu1"
        },
        {
            "binary_name": "libqt6webenginecore6",
            "binary_version": "6.2.4+dfsg-6ubuntu1"
        },
        {
            "binary_name": "libqt6webenginecore6-bin",
            "binary_version": "6.2.4+dfsg-6ubuntu1"
        },
        {
            "binary_name": "libqt6webenginequick6",
            "binary_version": "6.2.4+dfsg-6ubuntu1"
        },
        {
            "binary_name": "libqt6webenginequickdelegatesqml6",
            "binary_version": "6.2.4+dfsg-6ubuntu1"
        },
        {
            "binary_name": "libqt6webenginewidgets6",
            "binary_version": "6.2.4+dfsg-6ubuntu1"
        },
        {
            "binary_name": "qml6-module-qtquick-pdf",
            "binary_version": "6.2.4+dfsg-6ubuntu1"
        },
        {
            "binary_name": "qml6-module-qtwebengine",
            "binary_version": "6.2.4+dfsg-6ubuntu1"
        },
        {
            "binary_name": "qml6-module-qtwebengine-controlsdelegates",
            "binary_version": "6.2.4+dfsg-6ubuntu1"
        },
        {
            "binary_name": "qt6-image-formats-plugin-pdf",
            "binary_version": "6.2.4+dfsg-6ubuntu1"
        },
        {
            "binary_name": "qt6-pdf-dev",
            "binary_version": "6.2.4+dfsg-6ubuntu1"
        },
        {
            "binary_name": "qt6-webengine-dev",
            "binary_version": "6.2.4+dfsg-6ubuntu1"
        },
        {
            "binary_name": "qt6-webengine-dev-tools",
            "binary_version": "6.2.4+dfsg-6ubuntu1"
        },
        {
            "binary_name": "qt6-webengine-private-dev",
            "binary_version": "6.2.4+dfsg-6ubuntu1"
        }
    ]
}

Ubuntu:24.04:LTS / qt6-webengine

Package

Name: qt6-webengine
Purl: pkg:deb/ubuntu/qt6-webengine@6.4.2-final+dfsg-12ubuntu9?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.4.2-final+dfsg-11

6.4.2-final+dfsg-12

6.4.2-final+dfsg-12build1

6.4.2-final+dfsg-12ubuntu1

6.4.2-final+dfsg-12ubuntu7

6.4.2-final+dfsg-12ubuntu9

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libqt6pdf6",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "libqt6pdfquick6",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "libqt6pdfwidgets6",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "libqt6webengine6-data",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "libqt6webenginecore6",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "libqt6webenginecore6-bin",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "libqt6webenginequick6",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "libqt6webenginequickdelegatesqml6",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "libqt6webenginewidgets6",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "qml6-module-qtquick-pdf",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "qml6-module-qtwebengine",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "qml6-module-qtwebengine-controlsdelegates",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "qt6-image-formats-plugin-pdf",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "qt6-pdf-dev",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "qt6-webengine-dev",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "qt6-webengine-dev-tools",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "qt6-webengine-doc-dev",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "qt6-webengine-doc-html",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "qt6-webengine-examples",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        },
        {
            "binary_name": "qt6-webengine-private-dev",
            "binary_version": "6.4.2-final+dfsg-12ubuntu9"
        }
    ]
}

Ubuntu:25.10 / qt6-webengine

Package

Name: qt6-webengine
Purl: pkg:deb/ubuntu/qt6-webengine@6.9.2+dfsg-2?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.8.3+dfsg-0ubuntu1

6.8.3+dfsg-0ubuntu2

6.9.2+dfsg-2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libqt6pdf6",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "libqt6pdfquick6",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "libqt6pdfwidgets6",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "libqt6webengine6-data",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "libqt6webenginecore6",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "libqt6webenginecore6-bin",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "libqt6webenginequick6",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "libqt6webenginewidgets6",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "qml6-module-qtquick-pdf",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "qml6-module-qtwebengine",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "qml6-module-qtwebengine-controlsdelegates",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "qt6-image-formats-plugin-pdf",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "qt6-pdf-dev",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "qt6-pdf-private-dev",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "qt6-webengine-dev",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "qt6-webengine-dev-tools",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "qt6-webengine-doc-dev",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "qt6-webengine-doc-html",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "qt6-webengine-examples",
            "binary_version": "6.9.2+dfsg-2"
        },
        {
            "binary_name": "qt6-webengine-private-dev",
            "binary_version": "6.9.2+dfsg-2"
        }
    ]
}

Ubuntu:25.04 / qt6-webengine

Package

Name: qt6-webengine
Purl: pkg:deb/ubuntu/qt6-webengine@6.8.3+dfsg-0ubuntu1?arch=source&distro=plucky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.6.2+dfsg-5ubuntu2

6.7.2+dfsg-5

6.7.2+dfsg-8

6.8.1+dfsg-0ubuntu1

6.8.2+dfsg-0ubuntu2

6.8.2+dfsg-3fakesync1

6.8.3+dfsg-0ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libqt6pdf6",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "libqt6pdfquick6",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "libqt6pdfwidgets6",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "libqt6webengine6-data",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "libqt6webenginecore6",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "libqt6webenginecore6-bin",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "libqt6webenginequick6",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "libqt6webenginewidgets6",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "qml6-module-qtquick-pdf",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "qml6-module-qtwebengine",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "qml6-module-qtwebengine-controlsdelegates",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "qt6-image-formats-plugin-pdf",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "qt6-pdf-dev",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "qt6-webengine-dev",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "qt6-webengine-dev-tools",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "qt6-webengine-doc-dev",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "qt6-webengine-doc-html",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "qt6-webengine-examples",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        },
        {
            "binary_name": "qt6-webengine-private-dev",
            "binary_version": "6.8.3+dfsg-0ubuntu1"
        }
    ]
}