PRIOn knowledge basePRION:CVE-2012-5624Design/Logic Flaw
6.3 Medium
AI Score
Confidence
Low
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.002 Low
EPSS
Percentile
58.2%
The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-the-middle attackers to force the read of arbitrary local files and possibly obtain sensitive information via a file: URL to a QML application.
| CPE | Name | Operator | Version |
|---|---|---|---|
| ubuntu_linux | eq | 11.10 | |
| ubuntu_linux | eq | 12.10 | |
| ubuntu_linux | eq | 12.4 lts | |
| ubuntu_linux | eq | 10.4 lts | |
| qt | le | 4.8.3 | |
| qt | eq | 4.2.3 | |
| qt | eq | 1.41 | |
| qt | eq | 1.44 | |
| qt | eq | 1.45 | |
| qt | eq | 1.42 |
References
lists.opensuse.org/opensuse-updates/2013-01/msg00034.html
lists.opensuse.org/opensuse-updates/2013-01/msg00045.html
lists.opensuse.org/opensuse-updates/2013-01/msg00048.html
lists.qt-project.org/pipermail/announce/2012-November/000014.html
qt.gitorious.org/qt/qt/commit/96311def2466dd44de64d77a1c815b22fbf68f71
secunia.com/advisories/52217
www.openwall.com/lists/oss-security/2012/12/04/8
www.ubuntu.com/usn/USN-1723-1
bugzilla.redhat.com/show_bug.cgi?id=883415
codereview.qt-project.org/
Related
6.3 Medium
AI Score
Confidence
Low
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.002 Low
EPSS
Percentile
58.2%