CVE-2020-13962

Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1 is not affected, regardless of the Qt version.)

• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00004.htmlMailing List, Third Party Advisory
• https://bugreports.qt.io/browse/QTBUG-83450Issue Tracking, Vendor Advisory
• https://github.com/mumble-voip/mumble/issues/3679Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/mumble-voip/mumble/pull/4032Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X6EDPIIAQPVP2CHL2CHDHJ25EECA7UE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQJDBZUYMMF4R5QQKD2HTIKQU2NSKO63/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3IZY7LKJ6NAXQDFYFR4S7L5BBHYK53K/
• https://security.gentoo.org/glsa/202007-18Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00004.htmlMailing List, Third Party Advisory
• https://bugreports.qt.io/browse/QTBUG-83450Issue Tracking, Vendor Advisory
• https://github.com/mumble-voip/mumble/issues/3679Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/mumble-voip/mumble/pull/4032Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X6EDPIIAQPVP2CHL2CHDHJ25EECA7UE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQJDBZUYMMF4R5QQKD2HTIKQU2NSKO63/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3IZY7LKJ6NAXQDFYFR4S7L5BBHYK53K/
• https://security.gentoo.org/glsa/202007-18Third Party Advisory

Published

Jun 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13957Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.…9.8
• CVE-2020-13958A vulnerability in Apache OpenOffice scripting events allows…7.8
• CVE-2020-13959The default error page for VelocityView in Apache Velocity T…6.1
• CVE-2020-1396An elevation of privilege vulnerability exists when Windows …7.8
• CVE-2020-13960D-Link DSL 2730-U IN_1.10 and IN_1.11 and DIR-600M 3.04 devi…7.5
• CVE-2020-13961Strapi before 3.0.2 could allow a remote authenticated attac…6.5
• CVE-2020-13963SOPlanning before 1.47 has Incorrect Access Control because …9.8
• CVE-2020-13964An issue was discovered in Roundcube Webmail before 1.3.12 a…6.1
• CVE-2020-13965An issue was discovered in Roundcube Webmail before 1.3.12 a…6.1
• CVE-2020-13968CRK Business Platform <= 2019.1 allows can inject SQL statem…9.8
• CVE-2020-13969CRK Business Platform <= 2019.1 allows reflected XSS via err…6.1
• CVE-2020-1397An information disclosure vulnerability exists in Windows wh…6.5