CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

CVE details

CVE-2018-21035

In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).

Score
7.5 high
Published
2020-02-28
Links
NVD · cve.org

Affected ports (3)

PortPackageVersionStatusMaintainer
devel/linux-c7-qtlinux-c7-qt4.8.7_5unaddressedemulation@FreeBSD.org
misc/qt5-docqt5-doc5.12.2unaddressedkde@FreeBSD.org
x11-toolkits/linux-c7-qt-x11linux-c7-qt-x114.8.7_5unaddressedemulation@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>linux-c7-qt</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>qt5-doc</name>
	<range><lt>FIXME</lt></range>
      </package>
      <package>
	<name>linux-c7-qt-x11</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB
	for frames and 2GB for messages. Smaller limits cannot be configured.
	This makes it easier for attackers to cause a denial of service
	(memory consumption).</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2018-21035</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2018-21035</url>
    </references>
    <dates>
      <discovery>2020-02-28</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>