Medium ALAS2-2023-2036 1 CVE

Moderate: qt5-qtbase security update (Amazon Linux 2)

Published May 11, 2023 · Updated May 16, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-24607: When using the Qt SQL ODBC driver plugin, then it is possible to trigger a DOS with a specifically crafted string RESERVED NOTE: https://www.qt.io/blog/security-advisory-qt-sql-odbc-driver-plugin NOTE: https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02d (6.4) NOTE: https://download.qt.io/official_releases/qt/5.15/CVE-2023-24607-qtbase-5.15.diff

Fixed packages 12

Release	Package	Fixed in
Amazon Linux · 2	qt5-qtbase	0:5.9.2-3.amzn2.0.6
Amazon Linux · 2	qt5-qtbase-common	0:5.9.2-3.amzn2.0.6
Amazon Linux · 2	qt5-qtbase-debuginfo	0:5.9.2-3.amzn2.0.6
Amazon Linux · 2	qt5-qtbase-devel	0:5.9.2-3.amzn2.0.6
Amazon Linux · 2	qt5-qtbase-doc	0:5.9.2-3.amzn2.0.6
Amazon Linux · 2	qt5-qtbase-examples	0:5.9.2-3.amzn2.0.6
Amazon Linux · 2	qt5-qtbase-gui	0:5.9.2-3.amzn2.0.6
Amazon Linux · 2	qt5-qtbase-mysql	0:5.9.2-3.amzn2.0.6
Amazon Linux · 2	qt5-qtbase-odbc	0:5.9.2-3.amzn2.0.6
Amazon Linux · 2	qt5-qtbase-postgresql	0:5.9.2-3.amzn2.0.6
Amazon Linux · 2	qt5-qtbase-static	0:5.9.2-3.amzn2.0.6
Amazon Linux · 2	qt5-rpm-macros	0:5.9.2-3.amzn2.0.6

Vulnerabilities 1

Unscored —

CVE-2023-24607

Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of…

qtbase-opensource-src qtbase-opensource-src qt6-base qt6-base Debian Ubuntu Azure Linux

Apr 15, 2023

References

web
https://alas.aws.amazon.com/cve/html/CVE-2023-24607.html