CVE-2023-24607

EPSS 0.39%
Published 15.04.2023 01:15:07
Last modified 21.11.2024 07:48:13
Source cve@mitre.org
Teams watchlist Login
Open Login

Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3.

Affected products Warnungen 0 Metrics 2 CWE 0 References 11

Data is provided by the National Vulnerability Database (NVD)

Qt ≫ Qt Version >= 5.0.0 < 5.15.13

Qt ≫ Qt Version >= 6.0.0 < 6.2.8

Qt ≫ Qt Version >= 6.3.0 < 6.4.3

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.39%	0.593

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

https://codereview.qt-project.org/c/qt/qtbase/+/456216

Issue Tracking

https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456217

Permissions Required

https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456238

Permissions Required

https://download.qt.io/official_releases/qt/5.15/CVE-2023-24607-qtbase-5.15.diff

Vendor Advisory

https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02d

Patch

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html

https://www.qt.io/blog/security-advisory-qt-sql-odbc-driver-plugin

Product

https://www.qt.io/blog/tag/security

Release Notes

https://nvd.nist.gov/vuln/detail/CVE-2023-24607

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-24607

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-24607

EUVD