CVE-2023-24607
First published: Sat Apr 15 2023(Updated: )
Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Qt Qt | >=5.0.0<5.15.13 | |
| Qt Qt | >=6.0.0<6.2.8 | |
| Qt Qt | >=6.3.0<6.4.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://codereview.qt-project.org/c/qt/qtbase/+/456216
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456217
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456238
- https://download.qt.io/official_releases/qt/5.15/CVE-2023-24607-qtbase-5.15.diff
- https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02d
- https://www.qt.io/blog/security-advisory-qt-sql-odbc-driver-plugin
- https://www.qt.io/blog/tag/security
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Frequently Asked Questions
What is the vulnerability ID for this Qt vulnerability?
The vulnerability ID for this Qt vulnerability is CVE-2023-24607.
What is the severity of CVE-2023-24607?
The severity of CVE-2023-24607 is high with a CVSS score of 7.5.
How does CVE-2023-24607 result in a denial of service?
CVE-2023-24607 results in a denial of service by exploiting a crafted string when the SQL ODBC driver plugin is used.
Which versions of Qt are affected by CVE-2023-24607?
Versions 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3 of Qt are affected by CVE-2023-24607.
Are there any fixes available for CVE-2023-24607?
Yes, the fix for CVE-2023-24607 is available in Qt version 6.4.3.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/remedy
- agent/references
- agent/softwarecombine
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/qt
- canonical/qt qt
- version/qt qt/5.0.0
- version/qt qt/6.0.0
- version/qt qt/6.3.0