Vulnerability Description
Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3.
CVSS Score
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Qt | Qt | >= 5.0.0, < 5.15.13 |
References
- https://codereview.qt-project.org/c/qt/qtbase/+/456216Issue Tracking
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456217Permissions Required
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456238Permissions Required
- https://download.qt.io/official_releases/qt/5.15/CVE-2023-24607-qtbase-5.15.diffVendor Advisory
- https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02dPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://www.qt.io/blog/security-advisory-qt-sql-odbc-driver-pluginProduct
- https://www.qt.io/blog/tag/securityRelease Notes
- https://codereview.qt-project.org/c/qt/qtbase/+/456216Issue Tracking
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456217Permissions Required
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456238Permissions Required
- https://download.qt.io/official_releases/qt/5.15/CVE-2023-24607-qtbase-5.15.diffVendor Advisory
- https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02dPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://www.qt.io/blog/security-advisory-qt-sql-odbc-driver-pluginProduct
FAQ
What is CVE-2023-24607?
CVE-2023-24607 is a vulnerability with a CVSS score of 7.5 (HIGH). Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, a...
How severe is CVE-2023-24607?
CVE-2023-24607 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-24607?
Check the references section above for vendor advisories and patch information. Affected products include: Qt Qt.