Use-after-free in Qt - CVE-2024-30161

Vulnerability identifier: #VU96587

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-30161

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error when accessing the QNetworkReply header data. A remote attacker can perform a denial of service attack.

Qt
Oracle Solaris
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Micro
SUSE Package Hub 15
Desktop Applications Module
openSUSE Leap
libQt6OpenGLWidgets6-debuginfo
qt6-platformsupport-private-devel
qt6-platformtheme-gtk3-debuginfo
qt6-networkinformation-nm-debuginfo
qt6-networkinformation-nm
qt6-base-docs-html
qt6-sql-postgresql
qt6-printsupport-cups
qt6-test-private-devel
qt6-printsupport-cups-debuginfo
qt6-base-devel
qt6-networkinformation-glib
libQt6Widgets6-debuginfo
libQt6Gui6
libQt6PrintSupport6-debuginfo
qt6-base-common-devel
libQt6Test6
qt6-printsupport-devel
qt6-opengl-private-devel
libQt6Test6-debuginfo
qt6-network-devel
qt6-sql-postgresql-debuginfo
qt6-docs-common
qt6-base-private-devel
qt6-dbus-private-devel
qt6-base-examples-debuginfo
qt6-sql-unixODBC
qt6-xml-private-devel
qt6-sql-mysql-debuginfo
qt6-platformtheme-xdgdesktopportal-debuginfo
qt6-networkinformation-glib-debuginfo
qt6-base-common-devel-debuginfo
qt6-network-private-devel
qt6-platformtheme-gtk3
qt6-sql-mysql
qt6-base-docs-qch
qt6-printsupport-private-devel
qt6-base-examples
qt6-sql-unixODBC-debuginfo
qt6-sql-private-devel
qt6-platformtheme-xdgdesktopportal
libQt6Concurrent6
qt6-core-devel
qt6-opengl-devel
qt6-xml-devel
qt6-platformsupport-devel-static
libQt6Sql6-debuginfo
libQt6Network6-debuginfo
qt6-core-private-devel
libQt6Core6
qt6-widgets-private-devel
qt6-base-debugsource
qt6-dbus-devel
libQt6Concurrent6-debuginfo
qt6-sql-devel
qt6-network-tls
libQt6Sql6
qt6-test-devel
qt6-kmssupport-devel-static
qt6-concurrent-devel
qt6-gui-private-devel
libQt6Gui6-debuginfo
qt6-sql-sqlite
qt6-kmssupport-private-devel
libQt6OpenGLWidgets6
libQt6Network6
libQt6Xml6
qt6-base-debuginfo
libQt6Core6-debuginfo
qt6-network-tls-debuginfo
libQt6Widgets6
qt6-gui-devel
libQt6Xml6-debuginfo
qt6-openglwidgets-devel
libQt6DBus6-debuginfo
qt6-widgets-devel
libQt6OpenGL6
qt6-sql-sqlite-debuginfo
libQt6PrintSupport6
libQt6OpenGL6-debuginfo
libQt6DBus6

Install updates from vendor's website.

Qt - addressed in versions 6.5.6, 6.6.3
Oracle Solaris - update to 11.4 SRU 71
libQt6OpenGLWidgets6-debuginfo - update to 6.4.2-150500.3.17.1
qt6-platformsupport-private-devel - update to 6.4.2-150500.3.17.1
qt6-platformtheme-gtk3-debuginfo - update to 6.4.2-150500.3.17.1
qt6-networkinformation-nm-debuginfo - update to 6.4.2-150500.3.17.1
qt6-networkinformation-nm - update to 6.4.2-150500.3.17.1
qt6-base-docs-html - update to 6.4.2-150500.3.17.1
qt6-sql-postgresql - update to 6.4.2-150500.3.17.1
qt6-printsupport-cups - update to 6.4.2-150500.3.17.1
qt6-test-private-devel - update to 6.4.2-150500.3.17.1
qt6-printsupport-cups-debuginfo - update to 6.4.2-150500.3.17.1
qt6-base-devel - update to 6.4.2-150500.3.17.1
qt6-networkinformation-glib - update to 6.4.2-150500.3.17.1
libQt6Widgets6-debuginfo - update to 6.4.2-150500.3.17.1
libQt6Gui6 - update to 6.4.2-150500.3.17.1
libQt6PrintSupport6-debuginfo - update to 6.4.2-150500.3.17.1
qt6-base-common-devel - update to 6.4.2-150500.3.17.1
libQt6Test6 - update to 6.4.2-150500.3.17.1
qt6-printsupport-devel - update to 6.4.2-150500.3.17.1
qt6-opengl-private-devel - update to 6.4.2-150500.3.17.1
libQt6Test6-debuginfo - update to 6.4.2-150500.3.17.1
qt6-network-devel - update to 6.4.2-150500.3.17.1
qt6-sql-postgresql-debuginfo - update to 6.4.2-150500.3.17.1
qt6-docs-common - update to 6.4.2-150500.3.17.1
qt6-base-private-devel - update to 6.4.2-150500.3.17.1
qt6-dbus-private-devel - update to 6.4.2-150500.3.17.1
qt6-base-examples-debuginfo - update to 6.4.2-150500.3.17.1
qt6-sql-unixODBC - update to 6.4.2-150500.3.17.1
qt6-xml-private-devel - update to 6.4.2-150500.3.17.1
qt6-sql-mysql-debuginfo - update to 6.4.2-150500.3.17.1
qt6-platformtheme-xdgdesktopportal-debuginfo - update to 6.4.2-150500.3.17.1
qt6-networkinformation-glib-debuginfo - update to 6.4.2-150500.3.17.1
qt6-base-common-devel-debuginfo - update to 6.4.2-150500.3.17.1
qt6-network-private-devel - update to 6.4.2-150500.3.17.1
qt6-platformtheme-gtk3 - update to 6.4.2-150500.3.17.1
qt6-sql-mysql - update to 6.4.2-150500.3.17.1
qt6-base-docs-qch - update to 6.4.2-150500.3.17.1
qt6-printsupport-private-devel - update to 6.4.2-150500.3.17.1
qt6-base-examples - update to 6.4.2-150500.3.17.1
qt6-sql-unixODBC-debuginfo - update to 6.4.2-150500.3.17.1
qt6-sql-private-devel - update to 6.4.2-150500.3.17.1
qt6-platformtheme-xdgdesktopportal - update to 6.4.2-150500.3.17.1
libQt6Concurrent6 - update to 6.4.2-150500.3.17.1
qt6-core-devel - update to 6.4.2-150500.3.17.1
qt6-opengl-devel - update to 6.4.2-150500.3.17.1
qt6-xml-devel - update to 6.4.2-150500.3.17.1
qt6-platformsupport-devel-static - update to 6.4.2-150500.3.17.1
libQt6Sql6-debuginfo - update to 6.4.2-150500.3.17.1
libQt6Network6-debuginfo - update to 6.4.2-150500.3.17.1
qt6-core-private-devel - update to 6.4.2-150500.3.17.1
libQt6Core6 - update to 6.4.2-150500.3.17.1
qt6-widgets-private-devel - update to 6.4.2-150500.3.17.1
qt6-base-debugsource - update to 6.4.2-150500.3.17.1
qt6-dbus-devel - update to 6.4.2-150500.3.17.1
libQt6Concurrent6-debuginfo - update to 6.4.2-150500.3.17.1
qt6-sql-devel - update to 6.4.2-150500.3.17.1
qt6-network-tls - update to 6.4.2-150500.3.17.1
libQt6Sql6 - update to 6.4.2-150500.3.17.1
qt6-test-devel - update to 6.4.2-150500.3.17.1
qt6-kmssupport-devel-static - update to 6.4.2-150500.3.17.1
qt6-concurrent-devel - update to 6.4.2-150500.3.17.1
qt6-gui-private-devel - update to 6.4.2-150500.3.17.1
libQt6Gui6-debuginfo - update to 6.4.2-150500.3.17.1
qt6-sql-sqlite - update to 6.4.2-150500.3.17.1
qt6-kmssupport-private-devel - update to 6.4.2-150500.3.17.1
libQt6OpenGLWidgets6 - update to 6.4.2-150500.3.17.1
libQt6Network6 - update to 6.4.2-150500.3.17.1
libQt6Xml6 - update to 6.4.2-150500.3.17.1
qt6-base-debuginfo - update to 6.4.2-150500.3.17.1
libQt6Core6-debuginfo - update to 6.4.2-150500.3.17.1
qt6-network-tls-debuginfo - update to 6.4.2-150500.3.17.1
libQt6Widgets6 - update to 6.4.2-150500.3.17.1
qt6-gui-devel - update to 6.4.2-150500.3.17.1
libQt6Xml6-debuginfo - update to 6.4.2-150500.3.17.1
qt6-openglwidgets-devel - update to 6.4.2-150500.3.17.1
libQt6DBus6-debuginfo - update to 6.4.2-150500.3.17.1
qt6-widgets-devel - update to 6.4.2-150500.3.17.1
libQt6OpenGL6 - update to 6.4.2-150500.3.17.1
qt6-sql-sqlite-debuginfo - update to 6.4.2-150500.3.17.1
libQt6PrintSupport6 - update to 6.4.2-150500.3.17.1
libQt6OpenGL6-debuginfo - update to 6.4.2-150500.3.17.1
libQt6DBus6 - update to 6.4.2-150500.3.17.1

• https://codereview.qt-project.org/c/qt/qtbase/+/544314

• Denial of service in Trolltech Qt
• SUSE update for qt6-base
• Oracle Solaris update for thrid-party components