Summary
It was discovered that Qt did not correctly handle certain inputs when
using the SQL ODBC driver plugin. An attacker could possibly use this issue
to cause a denial of service. (CVE-2023-24607)
It was discovered that Qt did not correctly parse certain strict-transport-
security headers. An attacker could possibly use this issue to leak
sensitive information. This issue only affected Ubuntu 20.04 LTS and Ubuntu
22.04 LTS. (CVE-2023-32762)
It was discovered that Qt did not correctly handle certain inputs from DNS
servers. A remote attacker could possibly use this issue to execute
arbitrary code or cause a denial of service. (CVE-2023-33285)
It was discovered that Qt did not correctly validate certain CA
certificates for TLS. An attacker could possibly use this issue to gain
access to unauthorized resources. (CVE-2023-34410)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | qtbase-opensource-src | 5.5.1+dfsg-16ubuntu7.7+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | qtbase-opensource-src | 5.9.5+dfsg-0ubuntu2.6+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | qtbase-opensource-src | 5.12.8+dfsg-0ubuntu2.1+esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | qtbase-opensource-src | 5.15.3+dfsg-2ubuntu0.2+esm1 |
Vulnerabilities 4
-
Medium 5.3
An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorr…
-
Medium 5.3
An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. QDnsLookup ha…
-
Medium 5.3
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate valid…
-
Unscored —
Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of…