CVE-2013-0254
The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions...
CVE-2013-0254 is a low vulnerability (CVSS 3.6) in Qt, published February 6, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 38th percentile. Fixed in phonon-backend-gstreamer 1:4.6.2-26.el6_4.
- Severity
- 3.6 LowCVSS 2.0, NVD
- Exploit chance
- 0.43%EPSS, 38th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1:4.6.2-26.el6_4phonon-backend-gstreamer +48 more
Description
The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions including 4.4.0 uses weak permissions (world-readable and world-writable) for shared memory segments, which allows local users to read sensitive information or modify critical program data, as demonstrated by reading a pixmap being sent to an X server.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qt4-x11Debian:6.0 From an advisory covering 5 CVEs | before 4:4.6.3-4+squeeze3, plus listed versions 4:4.6.3-44:4.6.3-4+squeeze14:4.6.3-4+squeeze2 | 4:4.6.3-4+squeeze3 |
phonon-backend-gstreamerRed Hat:enterprise_linux:6::client | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qtRed Hat:enterprise_linux:6::client | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-debuginfoRed Hat:enterprise_linux:6::client | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-mysqlRed Hat:enterprise_linux:6::client | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-odbcRed Hat:enterprise_linux:6::client | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-postgresqlRed Hat:enterprise_linux:6::client | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-sqliteRed Hat:enterprise_linux:6::client | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-x11Red Hat:enterprise_linux:6::client | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-demosRed Hat:enterprise_linux:6::client | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
Show 39 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qt-develRed Hat:enterprise_linux:6::client | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-docRed Hat:enterprise_linux:6::client | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-examplesRed Hat:enterprise_linux:6::client | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
phonon-backend-gstreamerRed Hat:enterprise_linux:6::computenode | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qtRed Hat:enterprise_linux:6::computenode | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-debuginfoRed Hat:enterprise_linux:6::computenode | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-sqliteRed Hat:enterprise_linux:6::computenode | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-x11Red Hat:enterprise_linux:6::computenode | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-demosRed Hat:enterprise_linux:6::computenode | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-develRed Hat:enterprise_linux:6::computenode | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-docRed Hat:enterprise_linux:6::computenode | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-examplesRed Hat:enterprise_linux:6::computenode | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-mysqlRed Hat:enterprise_linux:6::computenode | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-odbcRed Hat:enterprise_linux:6::computenode | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-postgresqlRed Hat:enterprise_linux:6::computenode | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
phonon-backend-gstreamerRed Hat:enterprise_linux:6::server | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qtRed Hat:enterprise_linux:6::server | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-debuginfoRed Hat:enterprise_linux:6::server | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-develRed Hat:enterprise_linux:6::server | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-docRed Hat:enterprise_linux:6::server | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-mysqlRed Hat:enterprise_linux:6::server | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-odbcRed Hat:enterprise_linux:6::server | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-postgresqlRed Hat:enterprise_linux:6::server | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-sqliteRed Hat:enterprise_linux:6::server | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-x11Red Hat:enterprise_linux:6::server | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-demosRed Hat:enterprise_linux:6::server | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-examplesRed Hat:enterprise_linux:6::server | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
phonon-backend-gstreamerRed Hat:enterprise_linux:6::workstation | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qtRed Hat:enterprise_linux:6::workstation | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-debuginfoRed Hat:enterprise_linux:6::workstation | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-develRed Hat:enterprise_linux:6::workstation | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-docRed Hat:enterprise_linux:6::workstation | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-mysqlRed Hat:enterprise_linux:6::workstation | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-odbcRed Hat:enterprise_linux:6::workstation | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-postgresqlRed Hat:enterprise_linux:6::workstation | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-sqliteRed Hat:enterprise_linux:6::workstation | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-x11Red Hat:enterprise_linux:6::workstation | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-demosRed Hat:enterprise_linux:6::workstation | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
qt-examplesRed Hat:enterprise_linux:6::workstation | before 1:4.6.2-26.el6_4 | 1:4.6.2-26.el6_4 |
What each source reports
NVD Score used
The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions including 4.4.0 uses weak permissions (world-readable and world-writable) for shared memory segments, which allows local users to read sensitive information or modify critical program data, as demonstrated by reading a pixmap being sent to an X server.
- Record
CVE-2013-0254- CVSS 2.0
- 3.6 Low
AV:L/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions including 4.4.0 uses weak permissions (world-readable and world-writable) for shared memory segments, which allows local users to read sensitive information or modify critical program data, as demonstrated by reading a pixmap being sent to an X server.
- Record
CVE-2013-0254- Updated
- 2026-11-02
EUVDEUVD-2013-0285No score
The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions including 4.4.0 uses weak permissions (world-readable and world-writable) for shared memory segments, which allows local users to read sensitive information or modify critical program data, as demonstrated by reading a pixmap being sent to an X server.
- Record
EUVD-2013-0285- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g639-7h38-4849No score
The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions...
The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions including 4.4.0 uses weak permissions (world-readable and world-writable) for shared memory segments, which allows local users to read sensitive information or modify critical program data, as demonstrated by reading a pixmap being sent to an X server.
- Record
GHSA-g639-7h38-4849- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10180-1No score
libqt4-32bit-4.8.7-5.4 on GA media
These are all security issues fixed in the libqt4-32bit-4.8.7-5.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10180-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.opensuse.org/opensuse-updates/2013-03/msg00015.html
rhn.redhat.com/errata/RHSA-2013-0669.html
lists.qt-project.org/pipermail/announce/2013-February/000023.html
bugzilla.redhat.com/show_bug.cgi?id=907425
Show 19 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-0254
github.com/advisories/GHSA-g639-7h38-4849
access.redhat.com/errata/RHSA-2013:0669
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0669.json
cve.org/CVERecord?id=CVE-2013-0254
suse.com/security/cve/CVE-2009-0945