CVE-2023-24607
CVE-2023-24607
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3.
CVSS 7.5 · High · EPSS 1.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
qt6-base Debian:12
- Affected ranges
- ECOSYSTEM: < 6.4.2+dfsg-7
Update to 6.4.2+dfsg-7
qt6-base Debian:13
- Affected ranges
- ECOSYSTEM: < 6.4.2+dfsg-7
Update to 6.4.2+dfsg-7
qt6-base Debian:14
- Affected ranges
- ECOSYSTEM: < 6.4.2+dfsg-7
Update to 6.4.2+dfsg-7
qtbase-opensource-src Debian:12
- Affected ranges
- ECOSYSTEM: < 5.15.8+dfsg-3
Update to 5.15.8+dfsg-3
qtbase-opensource-src Debian:13
- Affected ranges
- ECOSYSTEM: < 5.15.8+dfsg-3
Update to 5.15.8+dfsg-3
qtbase-opensource-src Debian:14
- Affected ranges
- ECOSYSTEM: < 5.15.8+dfsg-3
Update to 5.15.8+dfsg-3
qtbase-opensource-src Ubuntu:Pro:16.04:LTS
- Versions
- 5.4.2+dfsg-2ubuntu9
- 5.5.1+dfsg-6ubuntu4
- 5.5.1+dfsg-10ubuntu2
- 5.5.1+dfsg-13ubuntu1
- 5.5.1+dfsg-13ubuntu2
- 5.5.1+dfsg-13ubuntu3
- 5.5.1+dfsg-14ubuntu1
- 5.5.1+dfsg-14ubuntu2
- 5.5.1+dfsg-14ubuntu3
- 5.5.1+dfsg-15ubuntu1
- 5.5.1+dfsg-16ubuntu1
- 5.5.1+dfsg-16ubuntu6
- 5.5.1+dfsg-16ubuntu7
- 5.5.1+dfsg-16ubuntu7.1
- 5.5.1+dfsg-16ubuntu7.2
- 5.5.1+dfsg-16ubuntu7.5
- 5.5.1+dfsg-16ubuntu7.6
- 5.5.1+dfsg-16ubuntu7.7
- Affected ranges
- ECOSYSTEM: < 5.5.1+dfsg-16ubuntu7.7+esm1
Update to 5.5.1+dfsg-16ubuntu7.7+esm1
qtbase-opensource-src-gles Ubuntu:16.04:LTS
- Versions
- 5.4.2+dfsg-2ubuntu9
- 5.5.1+dfsg-6ubuntu1
- 5.5.1+dfsg-10ubuntu1
- 5.5.1+dfsg-13ubuntu1
- 5.5.1+dfsg-13ubuntu2
- 5.5.1+dfsg-13ubuntu3
- 5.5.1+dfsg-14ubuntu1
- 5.5.1+dfsg-14ubuntu2
- 5.5.1+dfsg-14ubuntu3
- 5.5.1+dfsg-15ubuntu1
- 5.5.1+dfsg-16ubuntu1
- 5.5.1+dfsg-16ubuntu4
- 5.5.1+dfsg-16ubuntu5
- 5.5.1+dfsg-16ubuntu6
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qtbase-opensource-src Ubuntu:Pro:18.04:LTS
- Versions
- 5.9.1+dfsg-10ubuntu1
- 5.9.1+dfsg-10ubuntu2
- 5.9.2+dfsg-4ubuntu6
- 5.9.3+dfsg-0ubuntu1
- 5.9.3+dfsg-0ubuntu3
- 5.9.3+dfsg-0ubuntu4
- 5.9.4+dfsg-0ubuntu3
- 5.9.4+dfsg-0ubuntu4
- 5.9.5+dfsg-0ubuntu1
- 5.9.5+dfsg-0ubuntu2
- 5.9.5+dfsg-0ubuntu2.1
- 5.9.5+dfsg-0ubuntu2.3
- 5.9.5+dfsg-0ubuntu2.4
- 5.9.5+dfsg-0ubuntu2.5
- 5.9.5+dfsg-0ubuntu2.6
- Affected ranges
- ECOSYSTEM: < 5.9.5+dfsg-0ubuntu2.6+esm1
Update to 5.9.5+dfsg-0ubuntu2.6+esm1
qtbase-opensource-src Ubuntu:Pro:20.04:LTS
- Versions
- 5.12.4+dfsg-4ubuntu1
- 5.12.5+dfsg-2
- 5.12.5+dfsg-8
- 5.12.5+dfsg-8build1
- 5.12.5+dfsg-9build1
- 5.12.8+dfsg-0ubuntu1
- 5.12.8+dfsg-0ubuntu2.1
- Affected ranges
- ECOSYSTEM: < 5.12.8+dfsg-0ubuntu2.1+esm1
Update to 5.12.8+dfsg-0ubuntu2.1+esm1
qtbase-opensource-src-gles Ubuntu:20.04:LTS
- Versions
- 5.12.4+dfsg-1build1
- 5.12.5+dfsg-1
- 5.12.5+dfsg-2
- 5.12.8+dfsg-0ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qt6-base Ubuntu:22.04:LTS
- Versions
- 6.2.2+dfsg-5ubuntu1
- 6.2.2+dfsg-6ubuntu1
- 6.2.2+dfsg-6ubuntu2
- 6.2.4+dfsg-1ubuntu1
- 6.2.4+dfsg-2ubuntu1
- 6.2.4+dfsg-2ubuntu1.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qtbase-opensource-src-gles Ubuntu:22.04:LTS
- Versions
- 5.15.2+dfsg-4
- 5.15.2+dfsg-5
- 5.15.3+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qtbase-opensource-src Ubuntu:Pro:22.04:LTS
- Versions
- 5.15.2+dfsg-12
- 5.15.2+dfsg-13
- 5.15.2+dfsg-14
- 5.15.2+dfsg-14ubuntu1
- 5.15.2+dfsg-14ubuntu3
- 5.15.2+dfsg-15
- 5.15.3+dfsg-1
- 5.15.3+dfsg-2
- 5.15.3+dfsg-2ubuntu0.1
- 5.15.3+dfsg-2ubuntu0.2
- Affected ranges
- ECOSYSTEM: < 5.15.3+dfsg-2ubuntu0.2+esm1
Update to 5.15.3+dfsg-2ubuntu0.2+esm1
qt6-base Ubuntu:24.04:LTS
- Versions
- 6.4.2+dfsg-18
- 6.4.2+dfsg-19
- 6.4.2+dfsg-19build1
- 6.4.2+dfsg-20
- 6.4.2+dfsg-21
- 6.4.2+dfsg-21.1build4
- 6.4.2+dfsg-21.1build5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qtbase-opensource-src-gles Ubuntu:24.04:LTS
- Versions
- 5.15.10+dfsg-2
- 5.15.10+dfsg-3
- 5.15.12+dfsg-1
- 5.15.12+dfsg-1ubuntu1
- 5.15.12+dfsg-1ubuntu2
- 5.15.13+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qt6-base Ubuntu:25.10
- Versions
- 6.8.3+dfsg-0ubuntu2
- 6.8.3+dfsg-0ubuntu3
- 6.9.2+dfsg-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qtbase-opensource-src-gles Ubuntu:25.10
- Versions
- 5.15.15+dfsg-2
- 5.15.17+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qt6-base Ubuntu:26.10
- Versions
- 6.10.2+dfsg-7
- 6.10.2+dfsg-14ubuntu2
- 6.10.2+dfsg-15
- 6.10.2+dfsg-16
- 6.11.2+dfsg-4ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qtbase-opensource-src-gles Ubuntu:26.10
- Versions
- 5.15.18+dfsg-1
- 5.15.19+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qt6-base Ubuntu:26.04:LTS
- Versions
- 6.9.2+dfsg-1ubuntu1
- 6.9.2+dfsg-2
- 6.9.2+dfsg-3ubuntu1
- 6.9.2+dfsg-3ubuntu2
- 6.9.2+dfsg-4
- 6.10.2+dfsg-3
- 6.10.2+dfsg-6
- 6.10.2+dfsg-7
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qtbase-opensource-src-gles Ubuntu:26.04:LTS
- Versions
- 5.15.17+dfsg-1
- 5.15.17+dfsg-2
- 5.15.18+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://www.qt.io/blog/tag/security
- https://codereview.qt-project.org/c/qt/qtbase/+/456216
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456217
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456238
- https://download.qt.io/official_releases/qt/5.15/CVE-2023-24607-qtbase-5.15.diff
- https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02d
- https://www.qt.io/blog/security-advisory-qt-sql-odbc-driver-plugin
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://nvd.nist.gov/vuln/detail/CVE-2023-24607