Denial of Service Vulnerability in qtwebengine-opensource-src Package
Summary
UBUNTU-CVE-2020-23906: FFmpeg N-98388-g76a3ee996b allows attackers to cause a denial of service (DoS) via a crafted audio file due to insufficient verification of data authenticity. Affects qtwebengine-opensource-src versions 5.9.1+dfsg-4 – 5.9.5+dfsg-0ubuntu2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The qtwebengine-opensource-src package provides a set of libraries and tools for rendering web content in applications using the Qt framework. It is widely used in various applications to integrate web technologies seamlessly. However, this package has been found to be vulnerable to a denial of service (DoS) attack due to insufficient verification of data authenticity in audio files processed by FFmpeg.
Vulnerability Detail
The vulnerability, identified as CVE-2020-23906, originates from FFmpeg version N-98388-g76a3ee996b, which allows attackers to exploit crafted audio files. This exploitation can lead to a denial of service, causing applications to crash or become unresponsive. The technical aspect of this vulnerability lies in the inadequate validation of data authenticity, which can be leveraged by malicious actors to disrupt service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict the use of the affected libraries until the package is updated. This can be done by removing or disabling the qtwebengine components in your application configuration.
Conclusion
The qtwebengine-opensource-src package is vulnerable to a denial of service attack due to insufficient data verification in audio files. It is crucial to update to the latest patched version to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for qtwebengine-opensource-src →
FAQ
CVE-2020-23906 is a vulnerability in the qtwebengine-opensource-src package that allows for denial of service attacks via crafted audio files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 5.5, indicating a medium severity level.
If immediate updates are not possible, consider implementing the provided workaround to mitigate the risk until you can apply the patch.
For real-time monitoring and alerts on open-source vulnerabilities, you can visit Vulert at https://vulert.com.
Related vulnerabilities
Recent vulnerabilities recorded for qtwebengine-opensource-src.
