CVE-2023-24607
HIGHCVSS 7.5/10EPSS 1.32%
Last modified
CVE-2023-24607 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3.. EPSS estimates a 1.32% chance of exploitation in the next 30 days.
Description
Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Qt | Qt | >= 5.0.0, < 5.15.13 |
| Qt | Qt | >= 6.0.0, < 6.2.8 |
| Qt | Qt | >= 6.3.0, < 6.4.3 |
References
- https://codereview.qt-project.org/c/qt/qtbase/+/456216Issue Tracking
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456217Permissions Required
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456238Permissions Required
- https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02dPatch, Third Party Advisory
- https://www.qt.io/blog/tag/securityRelease Notes
- https://codereview.qt-project.org/c/qt/qtbase/+/456216Issue Tracking
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456217Permissions Required
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456238Permissions Required
- https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02dPatch, Third Party Advisory
- https://www.qt.io/blog/tag/securityRelease Notes
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-24607?
Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3.
How severe is CVE-2023-24607?
CVE-2023-24607 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 1.32% probability of exploitation in the next 30 days.
How do I fix CVE-2023-24607?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-24600OX App Suite before backend 7.10.6-rev37 allows authenticate…4.3
- CVE-2023-24601OX App Suite before frontend 7.10.6-rev24 allows XSS via a n…6.1
- CVE-2023-24602OX App Suite before frontend 7.10.6-rev24 allows XSS via dat…6.1
- CVE-2023-24603OX App Suite before backend 7.10.6-rev37 does not check size…6.5
- CVE-2023-24604OX App Suite before backend 7.10.6-rev37 does not check HTTP…4.3
- CVE-2023-24605OX App Suite before backend 7.10.6-rev37 does not enforce 2F…4.2
- CVE-2023-24609Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a l…7.5
- CVE-2023-2461Use after free in OS Inputs in Google Chrome on ChromeOS pri…8.8
- CVE-2023-24610NOSH 4a5cfdb allows remote authenticated users to execute PH…8.8
- CVE-2023-24612The PdfBook extension through 2.0.5 before b07b6a64 for Medi…9.8
- CVE-2023-24613The user interface of Array Networks AG Series and vxAG thro…4.9
- CVE-2023-24619Redpanda before 22.3.12 discloses cleartext AWS credentials.…5.5
Are you affected by CVE-2023-24607?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST