{"id":"CVE-2014-3755","aliases":["DEBIAN-CVE-2014-3755","EUVD-2014-3694","GHSA-3923-6jq3-5x25","MGASA-2014-0245","UBUNTU-CVE-2014-3755","openSUSE-SU-2024:10080-1"],"status":"published","title":"The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers...","description":"The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers to cause a denial of service (hang and resource consumption) via a local file reference in an (1) image tag or (2) XML stylesheet in an SVG file.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02521,"percentile":0.84965,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399"],"published":"2014-05-30T07:47:09Z","modified":"2026-10-23T15:47:28Z","fixes":[{"ecosystem":"Debian:12","package":"mumble","fixed_in":["1.2.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mumble","fixed_in":["1.2.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mumble","fixed_in":["1.2.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"mumble","fixed_in":["1.2.4-0.2ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-10.1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-14.1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-0.2ubuntu1.1"}]}],"versions":["1.2.3-349-g315b5f5-2.2ubuntu1","1.2.3-349-g315b5f5-2.2ubuntu2","1.2.3-349-g315b5f5-2.2ubuntu3","1.2.4-0.1ubuntu1","1.2.4-0.1ubuntu2","1.2.4-0.2ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.17-1.2"}]}],"bundled":6}],"products":[{"vendor":"mumble","product":"mumble"}],"references":[{"url":"http://mumble.info/security/Mumble-SA-2014-005.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://qt.gitorious.org/qt/mumble-developers-qt/commit/2147fa767980fe27a14f018b1528dbf880b96814","tags":["x_refsource_MISC","x_transferred","Exploit","evidence"]},{"url":"http://www.openwall.com/lists/oss-security/2014/05/15/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/05/15/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/67400","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3755"},{"url":"https://github.com/advisories/GHSA-3923-6jq3-5x25"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3755","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0245.html","tags":["advisory"]},{"url":"http://mumble.info/security/Mumble-SA-2014-006.txt","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2014/05/15/4","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3755","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3755","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3756","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3755","description":"The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers to cause a denial of service (hang and resource consumption) via a local file reference in an (1) image tag or (2) XML stylesheet in an SVG file.","status":"published","published":"2014-11-16T11:00:00Z","modified":"2024-08-06T10:57:16.137Z","updated_at":"2026-11-02T14:33:44.569327Z"}],"euvd":[{"id":"EUVD-2014-3694","description":"The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers to cause a denial of service (hang and resource consumption) via a local file reference in an (1) image tag or (2) XML stylesheet in an SVG file.","status":"published","published":"2014-11-16T11:00:00Z","modified":"2024-08-06T10:57:16Z","updated_at":"2026-11-03T01:57:09.370988Z"}],"ghsa":[{"id":"GHSA-3923-6jq3-5x25","title":"The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers...","description":"The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers to cause a denial of service (hang and resource consumption) via a local file reference in an (1) image tag or (2) XML stylesheet in an SVG file.","status":"published","published":"2022-05-17T04:21:34Z","modified":"2023-01-28T05:01:37Z","updated_at":"2026-11-02T14:43:35.577766Z"}],"nvd":[{"id":"CVE-2014-3755","description":"The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers to cause a denial of service (hang and resource consumption) via a local file reference in an (1) image tag or (2) XML stylesheet in an SVG file.","status":"published","published":"2014-11-16T11:59:02.853Z","modified":"2026-06-17T00:08:50.51Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"CVE-2014-3755","description":"The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers to cause a denial of service (hang and resource consumption) via a local file reference in an (1) image tag or (2) XML stylesheet in an SVG file.","status":"published","published":"2014-11-16T11:59:02Z","modified":"2026-04-16T06:17:52.84381496Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3755","description":"The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers to cause a denial of service (hang and resource consumption) via a local file reference in an (1) image tag or (2) XML stylesheet in an SVG file.","status":"published","published":"2014-11-16T11:59:02.853Z","modified":"2026-10-23T15:47:28.117148094Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0245","title":"Updated mumble packages fix two security vulnervabilitites","description":"Updated mumble packages fix security vulnerabilities:\n\nIn Mumble before 1.2.6, the Mumble client is vulnerable to a Denial of\nService attack when rendering crafted SVG files that contain references to\nfiles on the local computer, due to an issue in Qt's SVG renderer module.\nThis issue can be triggered remotely by an entity participating in a Mumble\nvoice chat, using text messages, channel comments, user comments and user\ntextures/avatars (CVE-2014-3755).\n\nIn Mumble before 1.2.6, The Mumble client did not properly HTML-escape some\nexternal strings before using them in a rich-text (HTML) context. In some\nsituations, this could be abused to perform a Denial of Service attack on a\nMumble client by causing it to load external files via the HTML\n(CVE-2014-3756).\n","status":"published","published":"2014-05-30T07:47:09Z","modified":"2026-04-16T06:25:53.361899142Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10080-1","title":"mumble-1.2.17-1.2 on GA media","description":"These are all security issues fixed in the mumble-1.2.17-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:46:38.240433Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"UBUNTU-CVE-2014-3755","description":"The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers to cause a denial of service (hang and resource consumption) via a local file reference in an (1) image tag or (2) XML stylesheet in an SVG file.","status":"published","published":"2014-11-16T11:59:00Z","modified":"2025-09-08T16:43:10Z","updated_at":"2026-11-02T15:54:09.010095Z"}]}}