NVD Vulnerability Detail

CVE-2023-24607

Summary	Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3.
Publication Date	April 15, 2023, 10:15 a.m.
Registration Date	April 15, 2023, 4 p.m.
Last Update	Nov. 21, 2024, 4:48 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	https://codereview.qt-project.org/c/qt/qtbase/+/456216	Issue Tracking
2	https://codereview.qt-project.org/c/qt/qtbase/+/456216	Issue Tracking
3	https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456217	Permissions Required
4	https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456217	Permissions Required
5	https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456238	Permissions Required
6	https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456238	Permissions Required
7	https://download.qt.io/official_releases/qt/5.15/CVE-2023-24607-qtbase-5.15.diff	Vendor Advisory
8	https://download.qt.io/official_releases/qt/5.15/CVE-2023-24607-qtbase-5.15.diff	Vendor Advisory
9	https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02d	Patch Third Party Advisory
10	https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02d	Patch Third Party Advisory
11	https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
12	https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
13	https://www.qt.io/blog/security-advisory-qt-sql-odbc-driver-plugin	Product
14	https://www.qt.io/blog/security-advisory-qt-sql-odbc-driver-plugin	Product
15	https://www.qt.io/blog/tag/security	Release Notes
16	https://www.qt.io/blog/tag/security	Release Notes

Common Vulnerabilities List

JVN Vulnerability Information

The Qt Company の Qt における脆弱性

Title	The Qt Company の Qt における脆弱性
Summary	The Qt Company の Qt には、不特定の脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダアドバイザリまたはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。
Publication Date	April 15, 2023, midnight
Registration Date	Dec. 1, 2023, 1:47 p.m.
Last Update	Dec. 1, 2023, 1:47 p.m.

Affected System

The Qt Company

Qt 5.0.0 以上 5.15.13 未満

Qt 6.0.0 以上 6.2.8 未満

Qt 6.3.0 以上 6.4.3 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2023-24607	https://www.cve.org/CVERecord?id=CVE-2023-24607
National Vulnerability Database (NVD)
2	CVE-2023-24607	https://nvd.nist.gov/vuln/detail/CVE-2023-24607

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/scap/cwe.html

その他

No	Name	URL
関連文書
1	codereview.qt-project.org (+/456216)	https://codereview.qt-project.org/c/qt/qtbase/+/456216
2	download.qt.io (CVE-2023-24607-qtbase-5.15.diff)	https://download.qt.io/official_releases/qt/5.15/CVE-2023-24607-qtbase-5.15.diff
3	github.com (aaf1381eab6292aa0444a5eadcc24165b6e1c02d)	https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02d
4	www.qt.io (security)	https://www.qt.io/blog/tag/security
5	www.qt.io (security-advisory-qt-sql-odbc-driver-plugin)	https://www.qt.io/blog/security-advisory-qt-sql-odbc-driver-plugin

Change Log

No	Changed Details	Date of change
1	[2023年12月01日] 掲載	Dec. 1, 2023, 1:46 p.m.