4.3

CVE-2012-5624

The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-the-middle attackers to force the read of arbitrary local files and possibly obtain sensitive information via a file: URL to a QML application.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Digia ≫ Qt Version <= 4.8.3
Qt ≫ Qt Version 1.41
Qt ≫ Qt Version 1.42
Qt ≫ Qt Version 1.43
Qt ≫ Qt Version 1.44
Qt ≫ Qt Version 1.45
Qt ≫ Qt Version 2.0.0
Qt ≫ Qt Version 2.0.1
Qt ≫ Qt Version 2.0.2
Qt ≫ Qt Version 3.3.0
Qt ≫ Qt Version 3.3.1
Qt ≫ Qt Version 3.3.2
Qt ≫ Qt Version 3.3.3
Qt ≫ Qt Version 3.3.4
Qt ≫ Qt Version 3.3.5
Qt ≫ Qt Version 3.3.6
Qt ≫ Qt Version 4.0.0
Qt ≫ Qt Version 4.0.1
Qt ≫ Qt Version 4.1.0
Qt ≫ Qt Version 4.1.1
Qt ≫ Qt Version 4.1.2
Qt ≫ Qt Version 4.1.3
Qt ≫ Qt Version 4.1.4
Qt ≫ Qt Version 4.1.5
Qt ≫ Qt Version 4.2.0
Qt ≫ Qt Version 4.2.1
Qt ≫ Qt Version 4.2.3
Qt ≫ Qt Version 4.3.0
Qt ≫ Qt Version 4.3.1
Qt ≫ Qt Version 4.3.2
Qt ≫ Qt Version 4.3.3
Qt ≫ Qt Version 4.3.4
Qt ≫ Qt Version 4.3.5
Qt ≫ Qt Version 4.4.0
Qt ≫ Qt Version 4.4.1
Qt ≫ Qt Version 4.4.2
Qt ≫ Qt Version 4.4.3
Qt ≫ Qt Version 4.5.0
Qt ≫ Qt Version 4.5.1
Qt ≫ Qt Version 4.5.2
Qt ≫ Qt Version 4.5.3
Qt ≫ Qt Version 4.6.0
Qt ≫ Qt Version 4.6.0 Update rc1
Qt ≫ Qt Version 4.6.1
Qt ≫ Qt Version 4.6.2
Qt ≫ Qt Version 4.6.3
Qt ≫ Qt Version 4.6.4
Qt ≫ Qt Version 4.6.5
Qt ≫ Qt Version 4.6.5 Update rc
Qt ≫ Qt Version 4.7.0
Qt ≫ Qt Version 4.7.1
Qt ≫ Qt Version 4.7.2
Qt ≫ Qt Version 4.7.3
Qt ≫ Qt Version 4.7.4
Qt ≫ Qt Version 4.7.5
Qt ≫ Qt Version 4.7.6
Qt ≫ Qt Version 4.7.6 Update rc
Qt ≫ Qt Version 4.8.0
Qt ≫ Qt Version 4.8.1
Qt ≫ Qt Version 4.8.2
Canonical ≫ Ubuntu Linux Version 10.04 Update - Edition lts
Canonical ≫ Ubuntu Linux Version 11.10
Canonical ≫ Ubuntu Linux Version 12.04 Update - Edition lts
Canonical ≫ Ubuntu Linux Version 12.10
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.94% 0.775
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://lists.opensuse.org/opensuse-updates/2013-01/msg00034.html
http://lists.opensuse.org/opensuse-updates/2013-01/msg00048.html
http://lists.opensuse.org/opensuse-updates/2013-01/msg00045.html
http://lists.qt-project.org/pipermail/announce/2012-November/000014.html
http://qt.gitorious.org/qt/qt/commit/96311def2466dd44de64d77a1c815b22fbf68f71
http://secunia.com/advisories/52217
Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/12/04/8
http://www.ubuntu.com/usn/USN-1723-1
https://bugzilla.redhat.com/show_bug.cgi?id=883415
https://codereview.qt-project.org/#change%2C40034