CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2023-32573 – qt: Uninitialized variable usage in m_unitsPerEm
https://notcve.org/view.php?id=CVE-2023-32573
In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled. A vulnerability was found in qt. The security flaw occurs due to uninitialized variable usage in m_unitsPerEm. • https://codereview.qt-project.org/c/qt/qtsvg/+/474093 https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UE3IHQZCEUFVOPWG75V2HDKXNUZBB4FX https://access.redhat.com/security/cve/CVE-2023-32573 https://bugzilla.redhat.com/show_bug.cgi?id=2208135 • CWE-369: Divide By Zero •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-24607
https://notcve.org/view.php?id=CVE-2023-24607
Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3. • https://codereview.qt-project.org/c/qt/qtbase/+/456216 https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456217 https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456238 https://download.qt.io/official_releases/qt/5.15/CVE-2023-24607-qtbase-5.15.diff https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02d https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html https://www.qt.io/blog/security-advisory-qt-sql-odbc-driver-plugin https: •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-25634
https://notcve.org/view.php?id=CVE-2022-25634
Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory. Qt versiones hasta 5.15.8 y versiones 6.x hasta 6.2.3, pueden cargar archivos de biblioteca del sistema desde un directorio de trabajo no deseado • https://codereview.qt-project.org/c/qt/qtbase/+/396440 https://codereview.qt-project.org/c/qt/qtbase/+/396689 https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/396690 https://download.qt.io/official_releases/qt/5.15/CVE-2022-25643-5.15.diff https://download.qt.io/official_releases/qt/6.2/CVE-2022-25643-6.2.diff • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-25255 – qt: QProcess could execute a binary from the current working directory when not found in the PATH
https://notcve.org/view.php?id=CVE-2022-25255
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH. En Qt versiones 5.9.x hasta 5.15.x anteriores a 5.15.9 y versiones 6.x anteriores a 6.2.4 en Linux y UNIX, QProcess podía ejecutar un binario del directorio de trabajo actual cuando no era encontrado en el PATH A flaw was found in qt. The vulnerability occurs due to executing binaries from the current directory when the loading path failed, leading to an uncontrolled path element vulnerability. This flaw allows an attacker to execute malicious executables. • https://codereview.qt-project.org/c/qt/qtbase/+/393113 https://codereview.qt-project.org/c/qt/qtbase/+/394914 https://codereview.qt-project.org/c/qt/qtbase/+/396020 https://download.qt.io/official_releases/qt/5.15/qprocess5-15.diff https://download.qt.io/official_releases/qt/6.2/qprocess6-2.diff https://access.redhat.com/security/cve/CVE-2022-25255 https://bugzilla.redhat.com/show_bug.cgi?id=2055505 • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 1CVE-2021-3481 – qt: Out of bounds read in function QRadialFetchSimd from crafted svg file
https://notcve.org/view.php?id=CVE-2021-3481
A flaw was found in Qt. An out-of-bounds read vulnerability was found in QRadialFetchSimd in qt/qtbase/src/gui/painting/qdrawhelper_p.h in Qt/Qtbase. While rendering and displaying a crafted Scalable Vector Graphics (SVG) file this flaw may lead to an unauthorized memory access. The highest threat from this vulnerability is to data confidentiality and the application availability. Se ha encontrado un fallo en Qt. • https://access.redhat.com/security/cve/CVE-2021-3481 https://bugreports.qt.io/browse/QTBUG-91507 https://bugzilla.redhat.com/show_bug.cgi?id=1931444 https://codereview.qt-project.org/c/qt/qtsvg/+/337646 https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html • CWE-125: Out-of-bounds Read •