{"id":"CVE-2013-4549","aliases":["DEBIAN-CVE-2013-4549","EUVD-2013-4408","GHSA-73gj-v8wr-fjfj","MGASA-2014-0009","MGASA-2014-0115","MGASA-2014-0263","UBUNTU-CVE-2013-4549","openSUSE-SU-2024:10180-1","openSUSE-SU-2024:10287-1"],"status":"published","title":"QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service...","description":"QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03021,"percentile":0.8755,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2013-12-05T00:00:00Z","modified":"2026-09-01T20:03:18Z","fixes":[{"ecosystem":"Debian:12","package":"qtbase-opensource-src","fixed_in":["5.1.1+dfsg-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qtbase-opensource-src","fixed_in":["5.1.1+dfsg-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qtbase-opensource-src","fixed_in":["5.1.1+dfsg-6"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"qt4","fixed_in":["4.8.5-1.3.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"qtbase5","fixed_in":["5.0.2-1.1.mga3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qt4-x11","fixed_in":["4:4.8.4+dfsg-0ubuntu20"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qtbase-opensource-src","fixed_in":["5.0.2+dfsg1-7ubuntu13"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phantomjs","fixed_in":["1.9.0-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1+dfsg-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1+dfsg-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1+dfsg-6"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"qt4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.5-1.3.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"qtbase5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2-1.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"qt3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8b-32.1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"qt3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8b-33.2.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qt4-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.8.4+dfsg-0ubuntu20"}]}],"versions":["4:4.8.4+dfsg-0ubuntu18","4:4.8.4+dfsg-0ubuntu19"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2+dfsg1-7ubuntu13"}]}],"versions":["5.0.2+dfsg1-7ubuntu11","5.0.2+dfsg1-7ubuntu12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phantomjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-1ubuntu0.1~esm1"}]}],"versions":["1.9.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qt3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8c-140.6"}]}],"bundled":3}],"products":[{"vendor":"digia","product":"qt"},{"vendor":"qt","product":"qt"}],"references":[{"url":"http://lists.qt-project.org/pipermail/announce/2013-December/000036.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"http://secunia.com/advisories/56166","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00104.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/56008","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00085.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://codereview.qt-project.org/#change%2C71010","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00106.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00044.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://blog.qt.digia.com/blog/2014/04/24/qt-4-8-6-released/","tags":["x_refsource_CONFIRM","x_transferred","article"]},{"url":"http://www.ubuntu.com/usn/USN-2057-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://codereview.qt-project.org/#change%2C71368","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00047.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132395.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4549"},{"url":"https://codereview.qt-project.org/#change,71010"},{"url":"https://codereview.qt-project.org/#change,71368"},{"url":"http://blog.qt.digia.com/blog/2014/04/24/qt-4-8-6-released"},{"url":"https://github.com/advisories/GHSA-73gj-v8wr-fjfj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4549","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0009.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12043","tags":["report"]},{"url":"http://www.ubuntu.com/usn/usn-2057-1/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0115.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12178","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2014-0263.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13509","tags":["report"]},{"url":"http://lists.qt-project.org/pipermail/announce/2014-April/000045.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-January/127076.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-June/134040.html","tags":["web"]},{"url":"http://advisories.mageia.org/MGASA-2014-0009.html","tags":["advisory"]},{"url":"http://advisories.mageia.org/MGASA-2014-0240.html","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-4549","tags":["report"]},{"url":"https://codereview.qt-project.org/#change,70708","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2057-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4549","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1860","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4549","description":"QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.","status":"published","published":"2013-12-23T22:00:00Z","modified":"2024-08-06T16:45:14.815Z","updated_at":"2026-11-02T14:34:58.193873Z"}],"euvd":[{"id":"EUVD-2013-4408","description":"QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.","status":"published","published":"2013-12-23T22:00:00Z","modified":"2024-08-06T16:45:14Z","updated_at":"2026-11-03T01:56:31.667445Z"}],"ghsa":[{"id":"GHSA-73gj-v8wr-fjfj","title":"QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service...","description":"QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.","status":"published","published":"2022-05-13T01:09:17Z","modified":"2025-04-11T04:18:25Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:15.391359Z"}],"nvd":[{"id":"CVE-2013-4549","description":"QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.","status":"published","published":"2013-12-23T22:55:02.88Z","modified":"2026-06-16T23:57:26.027Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:44.596064Z"}],"osv":[{"id":"CVE-2013-4549","description":"QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.","status":"published","published":"2013-12-23T22:55:02Z","modified":"2026-04-16T06:17:34.660445767Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4549","description":"QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.","status":"published","published":"2013-12-23T22:55:02.88Z","modified":"2026-09-01T20:03:18.421394926Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"MGASA-2014-0009","title":"Updated qt4 package fixes security vulnerability","description":"It was discovered that QXmlSimpleReader in Qt incorrectly handled XML\nentity expansion. An attacker could use this flaw to cause Qt applications\nto consume large amounts of resources, resulting in a denial of service\n(CVE-2013-4549).\n","status":"published","published":"2014-01-17T00:20:35Z","modified":"2026-04-16T06:24:07.635269061Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0115","title":"Updated qt5 packages fix security vulnerability.","description":"It was discovered that QXmlSimpleReader in Qt incorrectly handled XML\nentity expansion. An attacker could use this flaw to cause Qt applications\nto consume large amounts of resources, resulting in a denial of service\n(CVE-2013-4549)\n","status":"published","published":"2014-03-03T19:58:12Z","modified":"2026-04-16T06:24:32.547107226Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0263","title":"Updated qt3 packages fix security vulnerabilities","description":"Updated qt3 packages fix security vulnerabilities:\n\nQXmlSimpleReader in Qt versions prior to 5.2 supports expansion of\ninternal entities in XML documents without placing restrictions to\nensure the document does not cause excessive memory usage. If an\napplication using this API processes untrusted data then the\napplication may use unexpected amounts of memory if a malicious\ndocument is processed (CVE-2013-4549).\n\nA NULL pointer dereference flaw was found in QGIFFormat::fillRect in\nQtGui. If an application using the qt-x11 libraries opened a malicious\nGIF file with invalid width and height values, it could cause the\napplication to crash (CVE-2014-0190)..\n","status":"published","published":"2014-06-18T18:02:44Z","modified":"2026-04-16T06:23:45.437968337Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10180-1","title":"libqt4-32bit-4.8.7-5.4 on GA media","description":"These are all security issues fixed in the libqt4-32bit-4.8.7-5.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:34:43.783361Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10287-1","title":"qt3-3.3.8c-140.6 on GA media","description":"These are all security issues fixed in the qt3-3.3.8c-140.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:54.745373Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"UBUNTU-CVE-2013-4549","description":"QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.","status":"published","published":"2013-12-05T00:00:00Z","modified":"2026-04-22T09:23:58.075437Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}