{"id":"CVE-2014-3756","aliases":["DEBIAN-CVE-2014-3756","EUVD-2014-3695","GHSA-64pr-fwhg-9fg4","MGASA-2014-0245","UBUNTU-CVE-2014-3756","openSUSE-SU-2024:10080-1"],"status":"published","title":"The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an...","description":"The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service (hang and resource consumption) via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the (1) user or (2) channel name in a Qt dialog, (3) subject common name or (4) email address to the Certificate Wizard, or (5) server name in a tooltip.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0148,"percentile":0.74097,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-19"],"published":"2014-05-30T07:47:09Z","modified":"2026-10-23T15:47:37Z","fixes":[{"ecosystem":"Debian:12","package":"mumble","fixed_in":["1.2.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mumble","fixed_in":["1.2.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mumble","fixed_in":["1.2.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"mumble","fixed_in":["1.2.4-0.2ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-10.1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-14.1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-0.2ubuntu1.1"}]}],"versions":["1.2.3-349-g315b5f5-2.2ubuntu1","1.2.3-349-g315b5f5-2.2ubuntu2","1.2.3-349-g315b5f5-2.2ubuntu3","1.2.4-0.1ubuntu1","1.2.4-0.1ubuntu2","1.2.4-0.2ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mumble","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.17-1.2"}]}],"bundled":6}],"products":[{"vendor":"mumble","product":"mumble"}],"references":[{"url":"http://mumble.info/security/Mumble-SA-2014-006.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"http://www.securityfocus.com/bid/67401","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/05/15/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/05/15/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3756"},{"url":"https://github.com/advisories/GHSA-64pr-fwhg-9fg4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3756","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0245.html","tags":["advisory"]},{"url":"http://mumble.info/security/Mumble-SA-2014-005.txt","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2014/05/15/4","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3756","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3756","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3756","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3756","description":"The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service (hang and resource consumption) via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the (1) user or (2) channel name in a Qt dialog, (3) subject common name or (4) email address to the Certificate Wizard, or (5) server name in a tooltip.","status":"published","published":"2014-11-16T11:00:00Z","modified":"2024-08-06T10:57:16.733Z","updated_at":"2026-11-02T14:33:44.569327Z"}],"euvd":[{"id":"EUVD-2014-3695","description":"The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service (hang and resource consumption) via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the (1) user or (2) channel name in a Qt dialog, (3) subject common name or (4) email address to the Certificate Wizard, or (5) server name in a tooltip.","status":"published","published":"2014-11-16T11:00:00Z","modified":"2024-08-06T10:57:16Z","updated_at":"2026-11-03T01:57:09.370988Z"}],"ghsa":[{"id":"GHSA-64pr-fwhg-9fg4","title":"The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an...","description":"The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service (hang and resource consumption) via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the (1) user or (2) channel name in a Qt dialog, (3) subject common name or (4) email address to the Certificate Wizard, or (5) server name in a tooltip.","status":"published","published":"2022-05-17T04:21:33Z","modified":"2023-01-28T05:01:36Z","updated_at":"2026-11-02T14:43:35.577766Z"}],"nvd":[{"id":"CVE-2014-3756","description":"The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service (hang and resource consumption) via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the (1) user or (2) channel name in a Qt dialog, (3) subject common name or (4) email address to the Certificate Wizard, or (5) server name in a tooltip.","status":"published","published":"2014-11-16T11:59:03.887Z","modified":"2026-06-17T00:08:50.62Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-19"],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"CVE-2014-3756","description":"The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service (hang and resource consumption) via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the (1) user or (2) channel name in a Qt dialog, (3) subject common name or (4) email address to the Certificate Wizard, or (5) server name in a tooltip.","status":"published","published":"2014-11-16T11:59:03Z","modified":"2026-04-16T06:21:04.889235085Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3756","description":"The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service (hang and resource consumption) via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the (1) user or (2) channel name in a Qt dialog, (3) subject common name or (4) email address to the Certificate Wizard, or (5) server name in a tooltip.","status":"published","published":"2014-11-16T11:59:03.887Z","modified":"2026-10-23T15:47:37.077058933Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0245","title":"Updated mumble packages fix two security vulnervabilitites","description":"Updated mumble packages fix security vulnerabilities:\n\nIn Mumble before 1.2.6, the Mumble client is vulnerable to a Denial of\nService attack when rendering crafted SVG files that contain references to\nfiles on the local computer, due to an issue in Qt's SVG renderer module.\nThis issue can be triggered remotely by an entity participating in a Mumble\nvoice chat, using text messages, channel comments, user comments and user\ntextures/avatars (CVE-2014-3755).\n\nIn Mumble before 1.2.6, The Mumble client did not properly HTML-escape some\nexternal strings before using them in a rich-text (HTML) context. In some\nsituations, this could be abused to perform a Denial of Service attack on a\nMumble client by causing it to load external files via the HTML\n(CVE-2014-3756).\n","status":"published","published":"2014-05-30T07:47:09Z","modified":"2026-04-16T06:25:53.361899142Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10080-1","title":"mumble-1.2.17-1.2 on GA media","description":"These are all security issues fixed in the mumble-1.2.17-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:46:38.240433Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"UBUNTU-CVE-2014-3756","description":"The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service (hang and resource consumption) via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the (1) user or (2) channel name in a Qt dialog, (3) subject common name or (4) email address to the Certificate Wizard, or (5) server name in a tooltip.","status":"published","published":"2014-11-16T11:59:00Z","modified":"2025-09-08T16:43:10Z","updated_at":"2026-11-02T15:54:09.010095Z"}]}}