Every CVE Search/ Get API key

CVE-2023-45935

Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function...

4.2 MediumFix availableDisputed

Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.24%Up 0.2 points since Mar 27, 2024
90%50%10%1%

What each source reports

CVE List Score used 4.2

Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.

Record
CVE-2023-45935
CVSS 3.1
4.2 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2023-50198 4.2

Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.

Record
EUVD-2023-50198
CVSS 3.1
4.2 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-mfgg-7fpx-cp7p 4.2

Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function...

Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.

Record
GHSA-mfgg-7fpx-cp7p
CVSS 3.1
4.2 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
NVD 4.2

Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.

Record
CVE-2023-45935
CVSS 3.1
4.2 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVDEBIAN-CVE-2023-45935 4.2

Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.

Record
DEBIAN-CVE-2023-45935
CVSS 3.1
4.2 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1538 9.8

qt5-qtbase security update

This package provides base tools, such as string, xml, and network handling.

Security Fix(es):

Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.(CVE-2023-45935)

An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.(CVE-2024-25580)

Record
OESA-2024-1538
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 11 moreShow less
OSVOESA-2024-2572 6.2

qt6-qtbase security update

Qt is a software toolkit for developing applications.

Security Fix(es):

(CVE-2023-45935)

(CVE-2024-25580)

(CVE-2024-33861)

(CVE-2024-39936)

Record
OESA-2024-2572
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV No score

Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.

Record
CVE-2023-45935
Updated
2026-11-02
OSVOESA-2024-1537 No score

qt5-qtbase security update

This package provides base tools, such as string, xml, and network handling.

Security Fix(es):

Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.(CVE-2023-45935)

Record
OESA-2024-1537
Updated
2026-11-02
OSVOESA-2024-1539 No score

qt5-qtbase security update

This package provides base tools, such as string, xml, and network handling.

Security Fix(es):

Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.(CVE-2023-45935)

Record
OESA-2024-1539
Updated
2026-11-02
OSVOESA-2024-1540 No score

qt5-qtbase security update

This package provides base tools, such as string, xml, and network handling.

Security Fix(es):

Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.(CVE-2023-45935)

Record
OESA-2024-1540
Updated
2026-11-02
OSVOESA-2024-1614 No score

qt5-qtbase security update

This package provides base tools, such as string, xml, and network handling.

Security Fix(es):

Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.(CVE-2023-45935)

Record
OESA-2024-1614
Updated
2026-11-02
OSVSUSE-SU-2024:2873-1 No score

Security update for qt6-base

This update for qt6-base fixes the following issues:

  • CVE-2024-33861: Fixed an invalid pointer being passed as a callback which coud lead to modification of the stack (bsc#1223917)
  • CVE-2024-39936: Fixed information leakage due to process HTTP2 communication before encrypted() can be responded to (bsc#1227426)
  • CVE-2023-45935: Fixed NULL pointer dereference in QXcbConnection::initializeAllAtoms() due to anomalous behavior from the X server (bsc#1222120)
Record
SUSE-SU-2024:2873-1
Updated
2026-11-02
OSVSUSE-SU-2024:2882-1 No score

Security update for libqt5-qtbase

This update for libqt5-qtbase fixes the following issues:

  • CVE-2023-45935: Fixed NULL pointer dereference in QXcbConnection::initializeAllAtoms() due to anomalous behavior from the X server (bsc#1222120)
  • CVE-2024-39936: Fixed information leakage due to process HTTP2 communication before encrypted() can be responded to (bsc#1227426)
Record
SUSE-SU-2024:2882-1
Updated
2026-11-02
OSVSUSE-SU-2024:2883-1 No score

Security update for libqt5-qtbase

This update for libqt5-qtbase fixes the following issues:

  • CVE-2023-45935: Fixed NULL pointer dereference in QXcbConnection::initializeAllAtoms() due to anomalous behavior from the X server (bsc#1222120)
  • CVE-2024-39936: Fixed information leakage due to process HTTP2 communication before encrypted() can be responded to (bsc#1227426)
Record
SUSE-SU-2024:2883-1
Updated
2026-11-02
OSVSUSE-SU-2024:2890-1 No score

Security update for libqt5-qtbase

This update for libqt5-qtbase fixes the following issues:

  • CVE-2023-51714: Fixed an incorrect integer overflow check (bsc#1218413).
  • CVE-2024-39936: Fixed information leakage due to process HTTP2 communication before encrypted() can be responded to (bsc#1227426)
  • CVE-2023-45935: Fixed NULL pointer dereference in QXcbConnection::initializeAllAtoms() due to anomalous behavior from the X server (bsc#1222120)

Other fixes:

  • Add patch from upstream to fix a regression in the ODBC driver (bsc#1227513, QTBUG-112375)
  • Add upstream patch to fix a potential overflow in assemble_hpack_block()
Record
SUSE-SU-2024:2890-1
Updated
2026-11-02
OSVSUSE-SU-2024:2946-1 No score

Security update for libqt5-qtbase

This update for libqt5-qtbase fixes the following issues:

  • CVE-2023-37369: Fixed a buffer overflow in QXmlStreamReader (QTBUG-91889, bsc#1214327).
  • CVE-2023-45935: Fixed NULL pointer dereference in QXcbConnection::initializeAllAtoms() due to anomalous behavior from the X server (bsc#1222120)
  • CVE-2024-39936: Fixed information leakage due to process HTTP2 communication before encrypted() can be responded to (bsc#1227426)
  • CVE-2023-51714: Fixed an incorrect integer overflow check (bsc#1218413).

Other fixes:

  • Add patch from upstream to fix a regression in the ODBC driver (bsc#1227513, QTBUG-112375)
  • Add upstream patch to fix a potential overflow in assemble_hpack_block()
  • Use pkgconfig(icu-18n) to select current icu
Record
SUSE-SU-2024:2946-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
qt6-base
Debian:12
All versions, plus listed versions
6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12
Show 45 moreShow less
6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.11.2+dfsg-56.11.2+dfsg-5+sparc646.11.2+dfsg-66.11.2+dfsg-76.4.2+dfsg-106.4.2+dfsg-116.4.2+dfsg-11~bpo11+16.4.2+dfsg-126.4.2+dfsg-136.4.2+dfsg-146.4.2+dfsg-156.4.2+dfsg-166.4.2+dfsg-176.4.2+dfsg-186.4.2+dfsg-18+loong646.4.2+dfsg-196.4.2+dfsg-206.4.2+dfsg-216.4.2+dfsg-21.16.6.0+dfsg-16.6.0+dfsg-26.6.0+dfsg-36.6.0+dfsg-46.6.0+dfsg-56.6.0+dfsg-66.6.1+dfsg-16.6.1+dfsg-26.6.1+dfsg-3
None known
qt6-base
Debian:13
All versions, plus listed versions
6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12
Show 35 moreShow less
6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.11.2+dfsg-56.11.2+dfsg-5+sparc646.11.2+dfsg-66.11.2+dfsg-76.8.2+dfsg-106.8.2+dfsg-10.16.8.2+dfsg-96.8.2+dfsg-9+deb13u16.8.2+dfsg-9+deb13u26.9.1+dfsg-16.9.1+dfsg-26.9.1+dfsg-36.9.1+dfsg-46.9.1+dfsg-56.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-36.9.2+dfsg-4
None known
qt6-base
Debian:14
All versions, plus listed versions
6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12
Show 33 moreShow less
6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.11.2+dfsg-56.11.2+dfsg-5+sparc646.11.2+dfsg-66.11.2+dfsg-76.8.2+dfsg-106.8.2+dfsg-10.16.8.2+dfsg-96.9.1+dfsg-16.9.1+dfsg-26.9.1+dfsg-36.9.1+dfsg-46.9.1+dfsg-56.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-36.9.2+dfsg-4
None known
qtbase-opensource-src
Debian:12
All versions, plus listed versions
5.15.10+dfsg-15.15.10+dfsg-25.15.10+dfsg-35.15.10+dfsg-45.15.10+dfsg-5
Show 45 moreShow less
5.15.10+dfsg-65.15.10+dfsg-75.15.10+dfsg-7.15.15.10+dfsg-7.25.15.11+dfsg-15.15.12+dfsg-15.15.12+dfsg-25.15.12+dfsg-35.15.13+dfsg-15.15.13+dfsg-25.15.13+dfsg-35.15.13+dfsg-45.15.14+dfsg-15.15.15+dfsg-15.15.15+dfsg-25.15.15+dfsg-35.15.15+dfsg-45.15.15+dfsg-55.15.15+dfsg-65.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-55.15.19+dfsg-65.15.8+dfsg-115.15.8+dfsg-11+deb12u15.15.8+dfsg-11+deb12u25.15.8+dfsg-11+deb12u35.15.8+dfsg-125.15.8+dfsg-135.15.9+dfsg-15.15.9+dfsg-2
None known
qtbase-opensource-src
Debian:13
All versions, plus listed versions
5.15.15+dfsg-65.15.15+dfsg-6+deb13u15.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-1
Show 15 moreShow less
5.15.17+dfsg-25.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-55.15.19+dfsg-6
None known
qtbase-opensource-src
Debian:14
All versions, plus listed versions
5.15.15+dfsg-65.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-15.15.17+dfsg-2
Show 14 moreShow less
5.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-55.15.19+dfsg-6
None known
qtbase-opensource-src-gles
Debian:12
All versions, plus listed versions
5.15.10+dfsg-15.15.10+dfsg-25.15.10+dfsg-35.15.10+dfsg-45.15.10+dfsg-5
Show 13 moreShow less
5.15.10+dfsg-65.15.12+dfsg-15.15.13+dfsg-15.15.13+dfsg-25.15.15+dfsg-15.15.15+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-25.15.8+dfsg-35.15.9+dfsg-1
None known
qtbase-opensource-src-gles
Debian:13
All versions, plus listed versions
5.15.15+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-2
None known
qtbase-opensource-src-gles
Debian:14
All versions, plus listed versions
5.15.15+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.18+dfsg-15.15.19+dfsg-15.15.19+dfsg-2
None known
qt5-qtbase
openEuler:22.03-LTS-SP2
before 5.15.2-16.oe2203sp2
5.15.2-16.oe2203sp2
Show 28 moreShow less
Affected packages
PackageAffectedFixed
qt5-qtbase
openEuler:22.03-LTS-SP3
From an advisory covering 2 CVEs
before 5.15.2-16.oe2203sp3
5.15.2-16.oe2203sp3
qt5-qtbase
openEuler:20.03-LTS-SP1
before 5.11.1-22.oe1
5.11.1-22.oe1
qt5-qtbase
openEuler:20.03-LTS-SP4
before 5.11.1-22.oe2003sp4
5.11.1-22.oe2003sp4
qt5-qtbase
openEuler:22.03-LTS-SP1
before 5.15.2-16.oe2203sp1
5.15.2-16.oe2203sp1
qt6-qtbase
openEuler:24.03-LTS
From an advisory covering 4 CVEs
before 6.5.2-8.oe2403
6.5.2-8.oe2403
qt6-base
SUSE:Linux Enterprise Module for Desktop Applications 15 SP5
From an advisory covering 3 CVEs
before 6.4.2-150500.3.20.2
6.4.2-150500.3.20.2
qt6-base
SUSE:Linux Enterprise Module for Package Hub 15 SP5
From an advisory covering 3 CVEs
before 6.4.2-150500.3.20.2
6.4.2-150500.3.20.2
qt6-base
openSUSE:Leap 15.5
From an advisory covering 3 CVEs
before 6.4.2-150500.3.20.2
6.4.2-150500.3.20.2
qt6-base-docs
openSUSE:Leap 15.5
From an advisory covering 3 CVEs
before 6.4.2-150500.3.20.1
6.4.2-150500.3.20.1
libqt5-qtbase
SUSE:Linux Enterprise Module for Basesystem 15 SP6
From an advisory covering 2 CVEs
before 5.15.12+kde151-150600.3.6.1
5.15.12+kde151-150600.3.6.1
libqt5-qtbase
SUSE:Linux Enterprise Module for Desktop Applications 15 SP6
From an advisory covering 2 CVEs
before 5.15.12+kde151-150600.3.6.1
5.15.12+kde151-150600.3.6.1
libqt5-qtbase
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
before 5.15.12+kde151-150600.3.6.1
5.15.12+kde151-150600.3.6.1
libqt5-qtbase
SUSE:Linux Enterprise Module for Basesystem 15 SP5
From an advisory covering 2 CVEs
before 5.15.8+kde185-150500.4.22.1
5.15.8+kde185-150500.4.22.1
libqt5-qtbase
SUSE:Linux Enterprise Module for Desktop Applications 15 SP5
From an advisory covering 2 CVEs
before 5.15.8+kde185-150500.4.22.1
5.15.8+kde185-150500.4.22.1
libqt5-qtbase
openSUSE:Leap 15.5
From an advisory covering 2 CVEs
before 5.15.8+kde185-150500.4.22.1
5.15.8+kde185-150500.4.22.1
libqt5-qtbase
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 3 CVEs
before 5.15.2+kde294-150400.6.15.1
5.15.2+kde294-150400.6.15.1
libqt5-qtbase
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 3 CVEs
before 5.15.2+kde294-150400.6.15.1
5.15.2+kde294-150400.6.15.1
libqt5-qtbase
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 3 CVEs
before 5.15.2+kde294-150400.6.15.1
5.15.2+kde294-150400.6.15.1
libqt5-qtbase
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 3 CVEs
before 5.15.2+kde294-150400.6.15.1
5.15.2+kde294-150400.6.15.1
libqt5-qtbase
SUSE:Manager Proxy 4.3
From an advisory covering 3 CVEs
before 5.15.2+kde294-150400.6.15.1
5.15.2+kde294-150400.6.15.1
libqt5-qtbase
SUSE:Manager Server 4.3
From an advisory covering 3 CVEs
before 5.15.2+kde294-150400.6.15.1
5.15.2+kde294-150400.6.15.1
libqt5-qtbase
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 4 CVEs
before 5.12.7-150200.4.29.1
5.12.7-150200.4.29.1
libqt5-qtbase
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 4 CVEs
before 5.12.7-150200.4.29.1
5.12.7-150200.4.29.1
libqt5-qtbase
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 4 CVEs
before 5.12.7-150200.4.29.1
5.12.7-150200.4.29.1
libqt5-qtbase
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 4 CVEs
before 5.12.7-150200.4.29.1
5.12.7-150200.4.29.1
libqt5-qtbase
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 4 CVEs
before 5.12.7-150200.4.29.1
5.12.7-150200.4.29.1
libqt5-qtbase
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 4 CVEs
before 5.12.7-150200.4.29.1
5.12.7-150200.4.29.1
libqt5-qtbase
SUSE:Enterprise Storage 7.1
From an advisory covering 4 CVEs
before 5.12.7-150200.4.29.1
5.12.7-150200.4.29.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-45935 is a medium vulnerability (CVSS 4.2) in qt6-base, published March 27, 2024. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in qt5-qtbase 5.15.2-16.oe2203sp2.

References

Show 25 moreShow less
This page doesn't list everything

Left out here: 44 versions. The JSON record has them.

MoveEnter Open