Lucene search

K
osvGoogleOSV:SUSE-SU-2024:2890-1
HistoryAug 13, 2024 - 9:38 a.m.

Security update for libqt5-qtbase

2024-08-1309:38:11
Google
osv.dev
1
cve-2023-51714
integer overflow check
cve-2024-39936
information leakage
http2 communication
cve-2023-45935
null pointer dereference
qxcbconnection::initializeallatoms()
x server anomalous behavior
odbc driver regression fix
potential overflow fix
assemble_hpack_block

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

This update for libqt5-qtbase fixes the following issues:

  • CVE-2023-51714: Fixed an incorrect integer overflow check (bsc#1218413).
  • CVE-2024-39936: Fixed information leakage due to process HTTP2 communication before encrypted() can be responded to (bsc#1227426)
  • CVE-2023-45935: Fixed NULL pointer dereference in QXcbConnection::initializeAllAtoms() due to anomalous behavior from the X server (bsc#1222120)

Other fixes:

  • Add patch from upstream to fix a regression in the ODBC driver (bsc#1227513, QTBUG-112375)
  • Add upstream patch to fix a potential overflow in assemble_hpack_block()

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High