Lucene search

K
freebsdFreeBSDE2F981F1-AD9E-11EE-8B55-4CCC6ADDA413
HistoryDec 14, 2023 - 12:00 a.m.

QtNetwork -- potential buffer overflow

2023-12-1400:00:00
vuxml.freebsd.org
10
qtnetwork
buffer overflow
http2
integer overflow
internal buffers
unix

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.3%

Andy Shaw reports:

A potential integer overflow has been discovered in Qt’s HTTP2
implementation. If the HTTP2 implementation receives more than 4GiB
in total headers, or more than 2GiB for any given header pair, then
the internal buffers may overflow.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchqt5-network< 5.15.12p148_1UNKNOWN
FreeBSDanynoarchqt6-base< 6.6.1_2UNKNOWN

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.3%