CVE-2013-0254: Low severity trolltech qt vulnerability
A security flaw was found in the way QSharedMemory class implementation of the Qt toolkit created shared memory segments (they were created with world-readable and world-writeable permissions). A local attacker could use this flaw to read or alter content of particular shared memory segment, possibly leading to their ability to obtain sensitive information or influence behaviour of shared memory segment reader process.
Other sources
The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions including 4.4.0 uses weak permissions (world-readable and world-writable) for shared memory segments, which allows local users to read sensitive information or modify critical program data, as demonstrated by reading a pixmap being sent to an X server.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0254?
CVE-2013-0254 is rated as a moderate severity vulnerability due to its potential for local attackers to exploit shared memory segments.
How do I fix CVE-2013-0254?
To resolve CVE-2013-0254, upgrade Qt to version 5.0.1 or higher, or to 4.8.5 or higher.
Who is affected by CVE-2013-0254?
CVE-2013-0254 affects several versions of the Qt toolkit, specifically versions prior to 5.0.1 and 4.8.5.
What type of vulnerability is CVE-2013-0254?
CVE-2013-0254 is a local privilege escalation vulnerability related to shared memory permissions.
Can CVE-2013-0254 be exploited remotely?
CVE-2013-0254 cannot be exploited remotely as it requires local access to the affected system.