Buffer overflow in qt5-qtbase - CVE-2024-25580

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU87163

Buffer overflow in qt5-qtbase - CVE-2024-25580

Published: March 6, 2024


Vulnerability identifier: #VU87163
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-25580
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when reading KTX images. A remote attacker can pass a specially crafted image to the application, trigger memory corruption and perform a denial of service (DoS) attack.


Affected software

qt5-qtbase
IBM Cloud Pak for Watson AIOps
Gentoo Linux
Oracle Solaris
Red Hat CodeReady Linux Builder for ARM 64
Anolis OS
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
openEuler
Fedora
Red Hat OpenShift Container Platform
qtbase-opensource-src (Ubuntu package)
qt5-qtbase
qt5-qtbase-debuginfo
qt5-qtbase-odbc
qt5-qtbase-postgresql
qt5-qtbase-examples
qt5-qtbase-devel
qt5-qtbase-mysql
qt5-qtbase-private-devel
qt5-qtbase-static
qt5-qtbase-debugsource
qt5-qtbase-common
qt5-qtbase-gui
qt5-qtbase (Red Hat package)
dev-qt/qtgui
mingw-qt5-qt3d
mingw-qt5-qtwebsockets
mingw-qt5-qtmultimedia
mingw-qt5-qtquickcontrols
mingw-qt5-qtquickcontrols2
mingw-qt5-qtscript
mingw-qt5-qtsensors
mingw-qt5-qtserialport
mingw-qt5-qtsvg
mingw-qt5-qttools
mingw-qt5-qttranslations
mingw-qt5-qtwebchannel
mingw-qt5-qtwinextras
mingw-qt5-qtxmlpatterns
mingw-qt5-qtlocation
mingw-qt5-qtimageformats
mingw-qt5-qtgraphicaleffects
mingw-qt5-qtdeclarative
mingw-qt5-qtcharts
mingw-qt5-qtactiveqt
mingw-qt5-qtbase
dev-qt/qtnetwork
qt6-qtbase-private-devel
qt6-qtbase-devel
qt6-qtbase-debugsource
qt6-qtbase-debuginfo
qt6-qtbase
qt6-qtbase-examples
qt6-qtbase-gui
qt6-qtbase-ibase
qt6-qtbase-mysql
qt6-qtbase-odbc
qt6-qtbase-postgresql
qt6-qtbase-static
qt6-qtbase-common
mingw-qt6-qtshadertools
mingw-qt6-qt3d
mingw-qt6-qt5compat
mingw-qt6-qtactiveqt
mingw-qt6-qtbase
mingw-qt6-qtcharts
mingw-qt6-qtdeclarative
mingw-qt6-qtimageformats
mingw-qt6-qtlocation
mingw-qt6-qtmultimedia
mingw-qt6-qtserialport
mingw-qt6-qtsvg
mingw-qt6-qttools
mingw-qt6-qttranslations
mingw-qt6-qtwebchannel
mingw-qt6-qtwebsockets
mingw-qt6-qtpositioning
mingw-qt6-qtscxml
mingw-qt6-qtsensors
dev-qt/qtbase
Autodesk Infraworks

How to mitigate CVE-2024-25580

Install updates from vendor's website.

qt5-qtbase - update to 6.6.2
Oracle Solaris - update to 11.4 SRU 71
IBM Cloud Pak for Watson AIOps - update to 4.6.0
Red Hat OpenShift Container Platform - update to 4.13.45
qtbase-opensource-src (Ubuntu package) - addressed in versions 5.12.8+dfsg-0ubuntu2.1+esm2, 5.15.3+dfsg-2ubuntu0.2+esm2
qt5-qtbase - update to 5.15.2-16
qt5-qtbase-debuginfo - update to 5.15.2-16
qt5-qtbase-odbc - update to 5.15.2-16
qt5-qtbase-postgresql - update to 5.15.2-16
qt5-qtbase-examples - update to 5.15.2-16
qt5-qtbase-devel - update to 5.15.2-16
qt5-qtbase-mysql - update to 5.15.2-16
qt5-qtbase-private-devel - update to 5.15.2-16
qt5-qtbase-static - update to 5.15.2-16
qt5-qtbase-debugsource - update to 5.15.2-16
qt5-qtbase-common - update to 5.15.2-16
qt5-qtbase-gui - update to 5.15.2-16
qt5-qtbase - update to 5.15.3-5.0.3
qt5-qtbase-devel - update to 5.15.3-5.0.3
qt5-qtbase-examples - update to 5.15.3-5.0.3
qt5-qtbase-gui - update to 5.15.3-5.0.3
qt5-qtbase-mysql - update to 5.15.3-5.0.3
qt5-qtbase-odbc - update to 5.15.3-5.0.3
qt5-qtbase-postgresql - update to 5.15.3-5.0.3
qt5-qtbase-private-devel - update to 5.15.3-5.0.3
qt5-qtbase-static - update to 5.15.3-5.0.3
qt5-qtbase-common - update to 5.15.3-5.0.3
qt5-qtbase (Red Hat package) - addressed in versions 5.15.3-7.el8, 5.15.9-9.el9
dev-qt/qtgui - update to 5.15.12-r2
mingw-qt5-qt3d - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtwebsockets - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtmultimedia - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtquickcontrols - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtquickcontrols2 - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtscript - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtsensors - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtserialport - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtsvg - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qttools - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qttranslations - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtwebchannel - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtwinextras - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtxmlpatterns - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtlocation - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtimageformats - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtgraphicaleffects - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtdeclarative - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtcharts - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtactiveqt - addressed in versions 5.15.12-1.fc39, 5.15.12-1.fc40, 5.15.12-1.fc41
mingw-qt5-qtbase - addressed in versions 5.15.12-2.fc39, 5.15.12-2.fc40, 5.15.12-2.fc41
qt5-qtbase - update to 5.15.12-5.fc39
dev-qt/qtnetwork - update to 5.15.14-r1
qt6-qtbase-private-devel - update to 6.5.2-8
qt6-qtbase-devel - update to 6.5.2-8
qt6-qtbase-debugsource - update to 6.5.2-8
qt6-qtbase-debuginfo - update to 6.5.2-8
qt6-qtbase - update to 6.5.2-8
qt6-qtbase-examples - update to 6.5.2-8
qt6-qtbase-gui - update to 6.5.2-8
qt6-qtbase-ibase - update to 6.5.2-8
qt6-qtbase-mysql - update to 6.5.2-8
qt6-qtbase-odbc - update to 6.5.2-8
qt6-qtbase-postgresql - update to 6.5.2-8
qt6-qtbase-static - update to 6.5.2-8
qt6-qtbase-common - update to 6.5.2-8
mingw-qt6-qtshadertools - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qt3d - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qt5compat - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtactiveqt - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtbase - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtcharts - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtdeclarative - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtimageformats - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtlocation - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtmultimedia - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtserialport - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtsvg - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qttools - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qttranslations - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtwebchannel - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtwebsockets - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtpositioning - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtscxml - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
mingw-qt6-qtsensors - addressed in versions 6.6.2-1.fc40, 6.6.2-1.fc41
dev-qt/qtbase - update to 6.8.3-r1
Autodesk Infraworks - addressed in versions 2022.1.10.363, 2023.1.5.251, 2024.1.4.152, 2025.02.86

External References

Related Security Bulletins