CVE-2024-25580

This package provides base tools, such as string, xml, and network handling.

Security Fix(es):

Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.(CVE-2023-45935)

An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.(CVE-2024-25580)

Qt is a software toolkit for developing applications.

Security Fix(es):

(CVE-2023-45935)

(CVE-2024-25580)

(CVE-2024-33861)

(CVE-2024-39936)

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.

Security Fix(es):

• qt: incorrect integer overflow check (CVE-2023-51714)

• qtbase: potential buffer overflow when reading KTX images (CVE-2024-25580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.

Security Fix(es):

• qt: incorrect integer overflow check (CVE-2023-51714)
• qtbase: potential buffer overflow when reading KTX images (CVE-2024-25580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.

Security Fix(es):

• qt: incorrect integer overflow check (CVE-2023-51714)
• qtbase: potential buffer overflow when reading KTX images (CVE-2024-25580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.

An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.

• CVE-2025-5455: fix qDecodeDataUrl crash on malformed data URL with charset
• CVE-2024-25580: fix KTX file reading buffer overflow
• CVE-2024-39936: delay HTTP/2 communication until encrypted() can be responded to (includes prerequisite to emit encrypted() on H2 path)

network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check. (CVE-2023-51714) A buffer overflow and application crash can occur via a crafted KTX image file. (CVE-2024-25580) Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed. (CVE-2024-39936)

These are all security issues fixed in the libQt5Bootstrap-devel-static-32bit-5.15.12+kde151-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libQt6Concurrent6-6.6.2-2.1 package on the GA media of openSUSE Tumbleweed.

It was discovered that Qt did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code.