CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2020-13962

Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1 is not affected, regardless of the Qt version.)

Score
7.5 high
Published
2020-06-09
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
misc/qt5-docqt5-doc5.12.2unaddressedkde@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>qt5-doc</name>
	<range><lt>5.12.9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0
	and other products, mishandles OpenSSL's error queue, which can cause
	a denial of service to QSslSocket users. Because errors leak in
	unrelated TLS sessions, an unrelated session may be disconnected when
	any handshake fails. (Mumble 1.3.1 is not affected, regardless of the
	Qt version.)</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2020-13962</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2020-13962</url>
    </references>
    <dates>
      <discovery>2020-06-09</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>