Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
amazonAmazonALAS2-2023-2252
HistorySep 13, 2023 - 11:44 p.m.

Medium: qt5-qtbase

2023-09-1323:44:00
alas.aws.amazon.com
11

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.6 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

56.7%

JSON

Issue Overview:

Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory. (CVE-2022-25634)

An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion. (CVE-2023-38197)

Affected Packages:

qt5-qtbase

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update qt5-qtbase to update your system.

New Packages:

aarch64:  
    qt5-qtbase-5.9.2-3.amzn2.0.12.aarch64  
    qt5-qtbase-devel-5.9.2-3.amzn2.0.12.aarch64  
    qt5-qtbase-doc-5.9.2-3.amzn2.0.12.aarch64  
    qt5-qtbase-examples-5.9.2-3.amzn2.0.12.aarch64  
    qt5-qtbase-static-5.9.2-3.amzn2.0.12.aarch64  
    qt5-qtbase-mysql-5.9.2-3.amzn2.0.12.aarch64  
    qt5-qtbase-odbc-5.9.2-3.amzn2.0.12.aarch64  
    qt5-qtbase-postgresql-5.9.2-3.amzn2.0.12.aarch64  
    qt5-qtbase-gui-5.9.2-3.amzn2.0.12.aarch64  
    qt5-qtbase-debuginfo-5.9.2-3.amzn2.0.12.aarch64  
  
i686:  
    qt5-qtbase-5.9.2-3.amzn2.0.12.i686  
    qt5-qtbase-devel-5.9.2-3.amzn2.0.12.i686  
    qt5-qtbase-doc-5.9.2-3.amzn2.0.12.i686  
    qt5-qtbase-examples-5.9.2-3.amzn2.0.12.i686  
    qt5-qtbase-static-5.9.2-3.amzn2.0.12.i686  
    qt5-qtbase-mysql-5.9.2-3.amzn2.0.12.i686  
    qt5-qtbase-odbc-5.9.2-3.amzn2.0.12.i686  
    qt5-qtbase-postgresql-5.9.2-3.amzn2.0.12.i686  
    qt5-qtbase-gui-5.9.2-3.amzn2.0.12.i686  
    qt5-qtbase-debuginfo-5.9.2-3.amzn2.0.12.i686  
  
noarch:  
    qt5-qtbase-common-5.9.2-3.amzn2.0.12.noarch  
    qt5-rpm-macros-5.9.2-3.amzn2.0.12.noarch  
  
src:  
    qt5-qtbase-5.9.2-3.amzn2.0.12.src  
  
x86_64:  
    qt5-qtbase-5.9.2-3.amzn2.0.12.x86_64  
    qt5-qtbase-devel-5.9.2-3.amzn2.0.12.x86_64  
    qt5-qtbase-doc-5.9.2-3.amzn2.0.12.x86_64  
    qt5-qtbase-examples-5.9.2-3.amzn2.0.12.x86_64  
    qt5-qtbase-static-5.9.2-3.amzn2.0.12.x86_64  
    qt5-qtbase-mysql-5.9.2-3.amzn2.0.12.x86_64  
    qt5-qtbase-odbc-5.9.2-3.amzn2.0.12.x86_64  
    qt5-qtbase-postgresql-5.9.2-3.amzn2.0.12.x86_64  
    qt5-qtbase-gui-5.9.2-3.amzn2.0.12.x86_64  
    qt5-qtbase-debuginfo-5.9.2-3.amzn2.0.12.x86_64

Additional References

Red Hat: CVE-2022-25634, CVE-2023-38197

Mitre: CVE-2022-25634, CVE-2023-38197

OSVersionArchitecturePackageVersionFilename
Amazon Linux2aarch64qt5-qtbase< 5.9.2-3.amzn2.0.12qt5-qtbase-5.9.2-3.amzn2.0.12.aarch64.rpm
Amazon Linux2aarch64qt5-qtbase-devel< 5.9.2-3.amzn2.0.12qt5-qtbase-devel-5.9.2-3.amzn2.0.12.aarch64.rpm
Amazon Linux2aarch64qt5-qtbase-doc< 5.9.2-3.amzn2.0.12qt5-qtbase-doc-5.9.2-3.amzn2.0.12.aarch64.rpm
Amazon Linux2aarch64qt5-qtbase-examples< 5.9.2-3.amzn2.0.12qt5-qtbase-examples-5.9.2-3.amzn2.0.12.aarch64.rpm
Amazon Linux2aarch64qt5-qtbase-static< 5.9.2-3.amzn2.0.12qt5-qtbase-static-5.9.2-3.amzn2.0.12.aarch64.rpm
Amazon Linux2aarch64qt5-qtbase-mysql< 5.9.2-3.amzn2.0.12qt5-qtbase-mysql-5.9.2-3.amzn2.0.12.aarch64.rpm
Amazon Linux2aarch64qt5-qtbase-odbc< 5.9.2-3.amzn2.0.12qt5-qtbase-odbc-5.9.2-3.amzn2.0.12.aarch64.rpm
Amazon Linux2aarch64qt5-qtbase-postgresql< 5.9.2-3.amzn2.0.12qt5-qtbase-postgresql-5.9.2-3.amzn2.0.12.aarch64.rpm
Amazon Linux2aarch64qt5-qtbase-gui< 5.9.2-3.amzn2.0.12qt5-qtbase-gui-5.9.2-3.amzn2.0.12.aarch64.rpm
Amazon Linux2aarch64qt5-qtbase-debuginfo< 5.9.2-3.amzn2.0.12qt5-qtbase-debuginfo-5.9.2-3.amzn2.0.12.aarch64.rpm
Rows per page:
1-10 of 321

Related

nessus 19
debiancve 2
cbl_mariner 3
prion 2
redhatcve 2
openvas 12
cnvd 1
ubuntucve 2
cve 2
fedora 4
osv 6
ics 1
qt 1
oraclelinux 2
redhat 3
almalinux 2
debian 2
ibm 2
nessus
nessus
Amazon Linux 2 : qt5-qtbase (ALAS-2023-2252)
2023-09-20 00:00:00
Fedora 37 : mingw-qt6-qtbase (2023-ff372f9829)
2023-07-27 00:00:00
Fedora 38 : mingw-qt6-qtbase (2023-364ae10761)
2023-07-27 00:00:00
debiancve
debiancve
CVE-2022-25634
2022-03-02 15:15:00
CVE-2023-38197
2023-07-13 02:15:09
cbl_mariner
cbl_mariner
CVE-2022-25634 affecting package qt5-qtsvg 5.12.11-4
2022-03-19 16:40:52
CVE-2022-25634 affecting package qt5-qtsvg for versions less than 5.12.11-3
2022-04-26 19:57:36
CVE-2023-38197 affecting package qt5-qtbase for versions less than 5.12.11-9
2023-08-10 16:37:57
prion
prion
Directory traversal
2022-03-02 15:15:00
Privilege escalation
2023-07-13 02:15:00
redhatcve
redhatcve
CVE-2022-25634
2022-03-03 21:51:19
CVE-2023-38197
2023-07-19 07:37:40
openvas
openvas
Fedora: Security Advisory for mingw-qt6-qtbase (FEDORA-2023-364ae10761)
2023-07-28 00:00:00
Fedora: Security Advisory for mingw-qt6-qtbase (FEDORA-2023-ff372f9829)
2023-07-28 00:00:00
Fedora: Security Advisory for mingw-qt5-qtbase (FEDORA-2023-5ead27b6d2)
2023-07-28 00:00:00
cnvd
cnvd
Qt path traversal vulnerability
2022-03-04 00:00:00
ubuntucve
ubuntucve
CVE-2022-25634
2022-03-02 00:00:00
CVE-2023-38197
2023-07-13 00:00:00
cve
cve
CVE-2022-25634
2022-03-02 15:15:00
CVE-2023-38197
2023-07-13 02:15:09
fedora
fedora
[SECURITY] Fedora 38 Update: mingw-qt5-qtbase-5.15.10-2.fc38
2023-07-27 01:22:41
[SECURITY] Fedora 38 Update: mingw-qt6-qtbase-6.5.1-2.fc38
2023-07-27 01:22:38
[SECURITY] Fedora 37 Update: mingw-qt6-qtbase-6.5.1-2.fc37
2023-07-27 02:06:28
osv
osv
CVE-2023-38197
2023-07-13 02:15:09
CVE-2022-25634
2022-03-02 15:15:08
Moderate: qt5-qtbase security update
2023-11-14 00:00:00
ics
ics
​Siemens Software Center
2023-08-10 12:00:00
qt
qt
Security advisory: QLockFile, QAuthenticator, Windows platform plugin
2022-03-04 00:00:00
oraclelinux
oraclelinux
qt5-qtbase security update
2023-11-17 00:00:00
qt5 security and bug fix update
2023-11-12 00:00:00
redhat
redhat
(RHSA-2023:6967) Moderate: qt5-qtbase security update
2023-11-14 08:41:31
(RHSA-2023:6369) Moderate: qt5 security and bug fix update
2023-11-07 06:03:15
(RHSA-2023:7720) Low: Logging Subsystem 5.8.1- Red Hat OpenShift security update
2023-12-13 18:39:55
almalinux
almalinux
Moderate: qt5-qtbase security update
2023-11-14 00:00:00
Moderate: qt5 security and bug fix update
2023-11-07 00:00:00
debian
debian
[SECURITY] [DLA 3539-1] qt4-x11 security update
2023-08-22 22:40:50
[SECURITY] [DLA 3805-1] qtbase-opensource-src security update
2024-04-30 22:47:38
ibm
ibm
Security Bulletin: Netcool Operations Insights 1.6.12 addresses multiple security vulnerabilities.
2024-04-02 11:06:22
Security Bulletin: Multiple Vulnerabilities in CloudPak for AIOps
2024-01-31 19:31:55

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.6 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

56.7%

JSON
Related for ALAS2-2023-2252
nessus19debiancve2cbl_mariner3prion2redhatcve2openvas12cnvd1ubuntucve2cve2fedora4osv6ics1qt1oraclelinux2redhat3almalinux2debian2ibm2