Search CVE reports
21 – 30 of 60 results
There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be passed to QTextMarkdownImporter to trigger the overflow. This issue affects Qt from 6.8.0 to...
3 affected packages
qt6-base, qtbase-opensource-src, qtbase-opensource-src-gles
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qt6-base | Needs evaluation | Needs evaluation | Needs evaluation | Not in release | — |
| qtbase-opensource-src | Not affected | Not affected | Not affected | Not affected | Not affected |
| qtbase-opensource-src-gles | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | — |
encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).
3 affected packages
qt6-base, qtbase-opensource-src, qtbase-opensource-src-gles
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qt6-base | Not affected | Needs evaluation | Vulnerable | Not in release | — |
| qtbase-opensource-src | Ignored | Ignored | Ignored | Ignored | Ignored |
| qtbase-opensource-src-gles | Vulnerable | Vulnerable | Vulnerable | Needs evaluation | — |
Some fixes available 3 of 5
An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute...
1 affected package
qtbase-opensource-src
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qtbase-opensource-src | — | Fixed | Fixed | Fixed | Not affected |
Some fixes available 2 of 21
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
3 affected packages
qt6-base, qtbase-opensource-src, qtbase-opensource-src-gles
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qt6-base | Needs evaluation | Needs evaluation | Needs evaluation | Not in release | Not in release |
| qtbase-opensource-src | Not affected | Not affected | Fixed | Fixed | Not affected |
| qtbase-opensource-src-gles | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Not in release |
In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). (Earlier and later versions are unaffected.)
3 affected packages
qt6-base, qtbase-opensource-src, qtbase-opensource-src-gles
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qt6-base | Needs evaluation | Needs evaluation | Needs evaluation | Not in release | — |
| qtbase-opensource-src | Not affected | Not affected | Not affected | Not affected | Not affected |
| qtbase-opensource-src-gles | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | — |
Some fixes available 3 of 16
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
3 affected packages
qt6-base, qtbase-opensource-src, qtbase-opensource-src-gles
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qt6-base | Not affected | Not affected | Vulnerable | Not in release | Not in release |
| qtbase-opensource-src | Not affected | Not affected | Fixed | Fixed | Fixed |
| qtbase-opensource-src-gles | Not affected | Not affected | Needs evaluation | Needs evaluation | Not in release |
An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupted font is loaded via QFontDatabase::addApplicationFont{FromData], then...
4 affected packages
qt4-x11, qt6-base, qtbase-opensource-src, qtbase-opensource-src-gles
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qt4-x11 | Not in release | Not in release | Not in release | Not in release | Needs evaluation |
| qt6-base | Not affected | Vulnerable | Vulnerable | Not in release | Not in release |
| qtbase-opensource-src | Ignored | Ignored | Ignored | Ignored | Ignored |
| qtbase-opensource-src-gles | Ignored | Ignored | Ignored | Ignored | Not in release |
In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length.
4 affected packages
qt4-x11, qt6-base, qtbase-opensource-src, qtbase-opensource-src-gles
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qt4-x11 | Not in release | Not in release | Not in release | Not in release | Needs evaluation |
| qt6-base | Needs evaluation | Needs evaluation | Needs evaluation | Not in release | Not in release |
| qtbase-opensource-src | Not affected | Not affected | Ignored | Ignored | Ignored |
| qtbase-opensource-src-gles | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Not in release |
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion.
2 affected packages
qt6-base, qtbase-opensource-src
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qt6-base | Needs evaluation | Needs evaluation | Needs evaluation | Not in release | Not in release |
| qtbase-opensource-src | Not affected | Not affected | Not affected | Not affected | Not affected |
Some fixes available 4 of 33
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider whether the root of a chain is a configured CA certificate.
4 affected packages
qt4-x11, qt6-base, qtbase-opensource-src, qtbase-opensource-src-gles
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| qt4-x11 | Not in release | Not in release | Not in release | Not in release | Needs evaluation |
| qt6-base | Needs evaluation | Needs evaluation | Needs evaluation | Not in release | Not in release |
| qtbase-opensource-src | Not affected | Not affected | Fixed | Fixed | Fixed |
| qtbase-opensource-src-gles | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation | Not in release |