Buffer overflow in qt5-qtbase - CVE-2024-25580

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU87163

Buffer overflow in qt5-qtbase - CVE-2024-25580

Published: March 6, 2024


Vulnerability identifier: #VU87163
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-25580
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when reading KTX images. A remote attacker can pass a specially crafted image to the application, trigger memory corruption and perform a denial of service (DoS) attack.


Affected software

qt5-qtbase
IBM Cloud Pak for Watson AIOps
Oracle Solaris
Gentoo Linux
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for IBM z Systems
Anolis OS
Ubuntu
openEuler
Fedora
libqt5core5a (Ubuntu package)
libqt5gui5 (Ubuntu package)
qt5-qtbase
qt5-qtbase-gui
qt5-qtbase-debuginfo
qt5-qtbase-odbc
qt5-qtbase-postgresql
qt5-qtbase-examples
qt5-qtbase-devel
qt5-qtbase-mysql
qt5-qtbase-private-devel
qt5-qtbase-static
qt5-qtbase-debugsource
qt5-qtbase-common
qt5-qtbase (Red Hat package)
mingw-qt5-qt3d
mingw-qt5-qtsensors
mingw-qt5-qtgraphicaleffects
mingw-qt5-qtdeclarative
mingw-qt5-qtcharts
mingw-qt5-qtactiveqt
mingw-qt5-qtimageformats
mingw-qt5-qtlocation
mingw-qt5-qtmultimedia
mingw-qt5-qtquickcontrols
mingw-qt5-qtquickcontrols2
mingw-qt5-qtscript
mingw-qt5-qtserialport
mingw-qt5-qtsvg
mingw-qt5-qttools
mingw-qt5-qttranslations
mingw-qt5-qtwebchannel
mingw-qt5-qtwebsockets
mingw-qt5-qtwinextras
mingw-qt5-qtxmlpatterns
mingw-qt5-qtbase
qt6-qtbase-examples
qt6-qtbase
qt6-qtbase-debuginfo
qt6-qtbase-debugsource
qt6-qtbase-devel
qt6-qtbase-gui
qt6-qtbase-ibase
qt6-qtbase-mysql
qt6-qtbase-odbc
qt6-qtbase-postgresql
qt6-qtbase-private-devel
qt6-qtbase-static
qt6-qtbase-common
mingw-qt6-qtserialport
mingw-qt6-qt3d
mingw-qt6-qtwebsockets
mingw-qt6-qtwebchannel
mingw-qt6-qttranslations
mingw-qt6-qttools
mingw-qt6-qtsvg
mingw-qt6-qtshadertools
mingw-qt6-qtsensors
mingw-qt6-qtscxml
mingw-qt6-qtpositioning
mingw-qt6-qtmultimedia
mingw-qt6-qtlocation
mingw-qt6-qtimageformats
mingw-qt6-qtdeclarative
mingw-qt6-qtcharts
mingw-qt6-qtbase
mingw-qt6-qtactiveqt
mingw-qt6-qt5compat
dev-qt/qtgui
dev-qt/qtnetwork
dev-qt/qtbase
Red Hat OpenShift Container Platform
Autodesk Infraworks

How to mitigate CVE-2024-25580

Install updates from vendor's website.

qt5-qtbase - update to 6.6.2
Oracle Solaris - update to 11.4 SRU 71
libqt5core5a (Ubuntu package) - addressed in versions 5.12.8+dfsg-0ubuntu2.1+esm2, 5.15.3+dfsg-2ubuntu0.2+esm2
libqt5gui5 (Ubuntu package) - addressed in versions 5.12.8+dfsg-0ubuntu2.1+esm2, 5.15.3+dfsg-2ubuntu0.2+esm2
qt5-qtbase - update to 5.15.2-16
qt5-qtbase-gui - update to 5.15.2-16
qt5-qtbase-debuginfo - update to 5.15.2-16
qt5-qtbase-odbc - update to 5.15.2-16
qt5-qtbase-postgresql - update to 5.15.2-16
qt5-qtbase-examples - update to 5.15.2-16
qt5-qtbase-devel - update to 5.15.2-16
qt5-qtbase-mysql - update to 5.15.2-16
qt5-qtbase-private-devel - update to 5.15.2-16
qt5-qtbase-static - update to 5.15.2-16
qt5-qtbase-debugsource - update to 5.15.2-16
qt5-qtbase-common - update to 5.15.2-16
qt5-qtbase-mysql - update to 5.15.3-5.0.3
qt5-qtbase-common - update to 5.15.3-5.0.3
qt5-qtbase-odbc - update to 5.15.3-5.0.3
qt5-qtbase-postgresql - update to 5.15.3-5.0.3
qt5-qtbase-private-devel - update to 5.15.3-5.0.3
qt5-qtbase-static - update to 5.15.3-5.0.3
qt5-qtbase-gui - update to 5.15.3-5.0.3
qt5-qtbase-examples - update to 5.15.3-5.0.3
qt5-qtbase-devel - update to 5.15.3-5.0.3
qt5-qtbase - update to 5.15.3-5.0.3
qt5-qtbase (Red Hat package) - addressed in versions 5.15.3-7.el8, 5.15.9-9.el9
mingw-qt5-qt3d - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtsensors - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtgraphicaleffects - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtdeclarative - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtcharts - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtactiveqt - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtimageformats - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtlocation - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtmultimedia - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtquickcontrols - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtquickcontrols2 - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtscript - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtserialport - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtsvg - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qttools - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qttranslations - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtwebchannel - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtwebsockets - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtwinextras - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtxmlpatterns - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtbase - addressed in versions 5.15.12-2.fc39, 5.15.12-2.fc40, 5.15.12-2.fc41
qt5-qtbase - update to 5.15.12-5.fc39
qt6-qtbase-examples - update to 6.5.2-8
qt6-qtbase - update to 6.5.2-8
qt6-qtbase-debuginfo - update to 6.5.2-8
qt6-qtbase-debugsource - update to 6.5.2-8
qt6-qtbase-devel - update to 6.5.2-8
qt6-qtbase-gui - update to 6.5.2-8
qt6-qtbase-ibase - update to 6.5.2-8
qt6-qtbase-mysql - update to 6.5.2-8
qt6-qtbase-odbc - update to 6.5.2-8
qt6-qtbase-postgresql - update to 6.5.2-8
qt6-qtbase-private-devel - update to 6.5.2-8
qt6-qtbase-static - update to 6.5.2-8
qt6-qtbase-common - update to 6.5.2-8
mingw-qt6-qtserialport - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qt3d - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtwebsockets - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtwebchannel - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qttranslations - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qttools - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtsvg - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtshadertools - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtsensors - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtscxml - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtpositioning - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtmultimedia - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtlocation - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtimageformats - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtdeclarative - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtcharts - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtbase - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtactiveqt - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qt5compat - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
IBM Cloud Pak for Watson AIOps - update to 4.6.0
Red Hat OpenShift Container Platform - update to 4.13.45
Autodesk Infraworks - addressed in versions 2022.1.10.363, 2023.1.5.251, 2024.1.4.152, 2025.02.86
dev-qt/qtgui - update to 5.15.12-r2
dev-qt/qtnetwork - update to 5.15.14-r1
dev-qt/qtbase - update to 6.8.3-r1

External References

Related Security Bulletins