{"id":"CVE-2023-45935","aliases":["DEBIAN-CVE-2023-45935","EUVD-2023-50198","GHSA-mfgg-7fpx-cp7p","OESA-2024-1537","OESA-2024-1538","OESA-2024-1539","OESA-2024-1540","OESA-2024-1614","OESA-2024-2572","SUSE-SU-2024:2873-1","SUSE-SU-2024:2882-1","SUSE-SU-2024:2883-1","SUSE-SU-2024:2890-1","SUSE-SU-2024:2946-1"],"status":"disputed","title":"Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function...","description":"Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.0024,"percentile":0.15239,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2024-03-27T00:00:00Z","modified":"2026-10-26T18:02:34Z","fixes":[{"ecosystem":"openEuler:22.03-LTS-SP2","package":"qt5-qtbase","fixed_in":["5.15.2-16.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"qt5-qtbase","fixed_in":["5.11.1-22.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"qt5-qtbase","fixed_in":["5.11.1-22.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"qt5-qtbase","fixed_in":["5.15.2-16.oe2203sp1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.2+dfsg-1","6.10.2+dfsg-10","6.10.2+dfsg-10+hurd.1","6.10.2+dfsg-11","6.10.2+dfsg-12","6.10.2+dfsg-13","6.10.2+dfsg-14","6.10.2+dfsg-15","6.10.2+dfsg-16","6.10.2+dfsg-2","6.10.2+dfsg-3","6.10.2+dfsg-4","6.10.2+dfsg-5","6.10.2+dfsg-6","6.10.2+dfsg-7","6.10.2+dfsg-7+hurd.1","6.10.2+dfsg-8","6.10.2+dfsg-9","6.11.2+dfsg-1","6.11.2+dfsg-2","6.11.2+dfsg-3","6.11.2+dfsg-4","6.11.2+dfsg-5","6.11.2+dfsg-5+sparc64","6.11.2+dfsg-6","6.11.2+dfsg-7","6.4.2+dfsg-10","6.4.2+dfsg-11","6.4.2+dfsg-11~bpo11+1","6.4.2+dfsg-12","6.4.2+dfsg-13","6.4.2+dfsg-14","6.4.2+dfsg-15","6.4.2+dfsg-16","6.4.2+dfsg-17","6.4.2+dfsg-18","6.4.2+dfsg-18+loong64","6.4.2+dfsg-19","6.4.2+dfsg-20","6.4.2+dfsg-21","6.4.2+dfsg-21.1","6.6.0+dfsg-1","6.6.0+dfsg-2","6.6.0+dfsg-3","6.6.0+dfsg-4","6.6.0+dfsg-5","6.6.0+dfsg-6","6.6.1+dfsg-1","6.6.1+dfsg-2","6.6.1+dfsg-3","6.6.1+dfsg-4","6.6.1+dfsg-5","6.6.1+dfsg-6","6.6.2+dfsg-1","6.6.2+dfsg-10","6.6.2+dfsg-11","6.6.2+dfsg-12","6.6.2+dfsg-2","6.6.2+dfsg-3","6.6.2+dfsg-4","6.6.2+dfsg-5","6.6.2+dfsg-6","6.6.2+dfsg-7","6.6.2+dfsg-8","6.6.2+dfsg-9","6.7.2+dfsg-1","6.7.2+dfsg-2","6.7.2+dfsg-3","6.7.2+dfsg-4","6.7.2+dfsg-4+m68k","6.7.2+dfsg-5","6.7.2+dfsg-6","6.8.2+dfsg-1","6.8.2+dfsg-10","6.8.2+dfsg-10.1","6.8.2+dfsg-2","6.8.2+dfsg-3","6.8.2+dfsg-4","6.8.2+dfsg-5","6.8.2+dfsg-5+m68k","6.8.2+dfsg-6","6.8.2+dfsg-7","6.8.2+dfsg-8","6.8.2+dfsg-9","6.9.1+dfsg-1","6.9.1+dfsg-2","6.9.1+dfsg-3","6.9.1+dfsg-4","6.9.1+dfsg-5","6.9.2+dfsg-1","6.9.2+dfsg-2","6.9.2+dfsg-3","6.9.2+dfsg-4"]},{"source":"osv","ecosystem":"Debian:13","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.2+dfsg-1","6.10.2+dfsg-10","6.10.2+dfsg-10+hurd.1","6.10.2+dfsg-11","6.10.2+dfsg-12","6.10.2+dfsg-13","6.10.2+dfsg-14","6.10.2+dfsg-15","6.10.2+dfsg-16","6.10.2+dfsg-2","6.10.2+dfsg-3","6.10.2+dfsg-4","6.10.2+dfsg-5","6.10.2+dfsg-6","6.10.2+dfsg-7","6.10.2+dfsg-7+hurd.1","6.10.2+dfsg-8","6.10.2+dfsg-9","6.11.2+dfsg-1","6.11.2+dfsg-2","6.11.2+dfsg-3","6.11.2+dfsg-4","6.11.2+dfsg-5","6.11.2+dfsg-5+sparc64","6.11.2+dfsg-6","6.11.2+dfsg-7","6.8.2+dfsg-10","6.8.2+dfsg-10.1","6.8.2+dfsg-9","6.8.2+dfsg-9+deb13u1","6.8.2+dfsg-9+deb13u2","6.9.1+dfsg-1","6.9.1+dfsg-2","6.9.1+dfsg-3","6.9.1+dfsg-4","6.9.1+dfsg-5","6.9.2+dfsg-1","6.9.2+dfsg-2","6.9.2+dfsg-3","6.9.2+dfsg-4"]},{"source":"osv","ecosystem":"Debian:14","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.2+dfsg-1","6.10.2+dfsg-10","6.10.2+dfsg-10+hurd.1","6.10.2+dfsg-11","6.10.2+dfsg-12","6.10.2+dfsg-13","6.10.2+dfsg-14","6.10.2+dfsg-15","6.10.2+dfsg-16","6.10.2+dfsg-2","6.10.2+dfsg-3","6.10.2+dfsg-4","6.10.2+dfsg-5","6.10.2+dfsg-6","6.10.2+dfsg-7","6.10.2+dfsg-7+hurd.1","6.10.2+dfsg-8","6.10.2+dfsg-9","6.11.2+dfsg-1","6.11.2+dfsg-2","6.11.2+dfsg-3","6.11.2+dfsg-4","6.11.2+dfsg-5","6.11.2+dfsg-5+sparc64","6.11.2+dfsg-6","6.11.2+dfsg-7","6.8.2+dfsg-10","6.8.2+dfsg-10.1","6.8.2+dfsg-9","6.9.1+dfsg-1","6.9.1+dfsg-2","6.9.1+dfsg-3","6.9.1+dfsg-4","6.9.1+dfsg-5","6.9.2+dfsg-1","6.9.2+dfsg-2","6.9.2+dfsg-3","6.9.2+dfsg-4"]},{"source":"osv","ecosystem":"Debian:12","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.10+dfsg-1","5.15.10+dfsg-2","5.15.10+dfsg-3","5.15.10+dfsg-4","5.15.10+dfsg-5","5.15.10+dfsg-6","5.15.10+dfsg-7","5.15.10+dfsg-7.1","5.15.10+dfsg-7.2","5.15.11+dfsg-1","5.15.12+dfsg-1","5.15.12+dfsg-2","5.15.12+dfsg-3","5.15.13+dfsg-1","5.15.13+dfsg-2","5.15.13+dfsg-3","5.15.13+dfsg-4","5.15.14+dfsg-1","5.15.15+dfsg-1","5.15.15+dfsg-2","5.15.15+dfsg-3","5.15.15+dfsg-4","5.15.15+dfsg-5","5.15.15+dfsg-6","5.15.16+dfsg-1","5.15.16+dfsg-2","5.15.17+dfsg-1","5.15.17+dfsg-2","5.15.17+dfsg-3","5.15.17+dfsg-4","5.15.17+dfsg-5","5.15.17+dfsg-6","5.15.17+dfsg-7","5.15.17+dfsg-8","5.15.18+dfsg-1","5.15.18+dfsg-2","5.15.19+dfsg-1","5.15.19+dfsg-2","5.15.19+dfsg-3","5.15.19+dfsg-4","5.15.19+dfsg-5","5.15.19+dfsg-6","5.15.8+dfsg-11","5.15.8+dfsg-11+deb12u1","5.15.8+dfsg-11+deb12u2","5.15.8+dfsg-11+deb12u3","5.15.8+dfsg-12","5.15.8+dfsg-13","5.15.9+dfsg-1","5.15.9+dfsg-2","5.15.9+dfsg-3"]},{"source":"osv","ecosystem":"Debian:13","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-6","5.15.15+dfsg-6+deb13u1","5.15.16+dfsg-1","5.15.16+dfsg-2","5.15.17+dfsg-1","5.15.17+dfsg-2","5.15.17+dfsg-3","5.15.17+dfsg-4","5.15.17+dfsg-5","5.15.17+dfsg-6","5.15.17+dfsg-7","5.15.17+dfsg-8","5.15.18+dfsg-1","5.15.18+dfsg-2","5.15.19+dfsg-1","5.15.19+dfsg-2","5.15.19+dfsg-3","5.15.19+dfsg-4","5.15.19+dfsg-5","5.15.19+dfsg-6"]},{"source":"osv","ecosystem":"Debian:14","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-6","5.15.16+dfsg-1","5.15.16+dfsg-2","5.15.17+dfsg-1","5.15.17+dfsg-2","5.15.17+dfsg-3","5.15.17+dfsg-4","5.15.17+dfsg-5","5.15.17+dfsg-6","5.15.17+dfsg-7","5.15.17+dfsg-8","5.15.18+dfsg-1","5.15.18+dfsg-2","5.15.19+dfsg-1","5.15.19+dfsg-2","5.15.19+dfsg-3","5.15.19+dfsg-4","5.15.19+dfsg-5","5.15.19+dfsg-6"]},{"source":"osv","ecosystem":"Debian:12","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.10+dfsg-1","5.15.10+dfsg-2","5.15.10+dfsg-3","5.15.10+dfsg-4","5.15.10+dfsg-5","5.15.10+dfsg-6","5.15.12+dfsg-1","5.15.13+dfsg-1","5.15.13+dfsg-2","5.15.15+dfsg-1","5.15.15+dfsg-2","5.15.17+dfsg-1","5.15.17+dfsg-2","5.15.18+dfsg-1","5.15.19+dfsg-1","5.15.19+dfsg-2","5.15.8+dfsg-3","5.15.9+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-2","5.15.17+dfsg-1","5.15.17+dfsg-2","5.15.18+dfsg-1","5.15.19+dfsg-1","5.15.19+dfsg-2"]},{"source":"osv","ecosystem":"Debian:14","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-2","5.15.17+dfsg-1","5.15.17+dfsg-2","5.15.18+dfsg-1","5.15.19+dfsg-1","5.15.19+dfsg-2"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-16.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-16.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.1-22.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.1-22.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-16.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"qt6-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-8.oe2403"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-150500.3.20.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-150500.3.20.2"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-150500.3.20.2"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"qt6-base-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-150500.3.20.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.12+kde151-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.12+kde151-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.12+kde151-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.8+kde185-150500.4.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.8+kde185-150500.4.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.8+kde185-150500.4.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2+kde294-150400.6.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2+kde294-150400.6.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2+kde294-150400.6.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2+kde294-150400.6.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2+kde294-150400.6.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2+kde294-150400.6.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-150200.4.29.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-150200.4.29.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-150200.4.29.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-150200.4.29.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-150200.4.29.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-150200.4.29.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-150200.4.29.1"}]}],"bundled":4}],"references":[{"url":"https://bugreports.qt.io/browse/QTBUG-115599","tags":["x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jan/61","tags":["mailing-list","x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/176815/qt-6.6-6.5-6.2-Null-Pointer.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45935","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mfgg-7fpx-cp7p"},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-45935","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1537","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1538","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25580","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1539","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1540","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1614","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2572","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-33861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39936","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242873-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222120","tags":["report"]},{"url":"https://bugzilla.suse.com/1223917","tags":["report"]},{"url":"https://bugzilla.suse.com/1227426","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-33861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39936","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242882-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242883-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242890-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218413","tags":["report"]},{"url":"https://bugzilla.suse.com/1227513","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-51714","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242946-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214327","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-37369","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-45935","description":"Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.","status":"disputed","published":"2024-03-27T00:00:00Z","modified":"2025-11-04T18:18:31.289Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-50198","description":"Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.","status":"published","published":"2024-03-27T00:00:00Z","modified":"2025-11-04T18:18:31Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:24.543935Z"}],"ghsa":[{"id":"GHSA-mfgg-7fpx-cp7p","title":"Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function...","description":"Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.","status":"published","published":"2024-03-27T06:30:32Z","modified":"2025-11-04T21:31:23Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:04:36.536202Z"}],"nvd":[{"id":"CVE-2023-45935","description":"Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.","status":"disputed","published":"2024-03-27T05:15:47.377Z","modified":"2026-06-17T06:29:48.917Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:09:10.192572Z"}],"osv":[{"id":"DEBIAN-CVE-2023-45935","description":"Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.","status":"published","published":"2024-03-27T05:15:47.377Z","modified":"2026-10-26T18:02:34.915005361Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"OESA-2024-1538","title":"qt5-qtbase security update","description":"This package provides base tools, such as string, xml, and network handling.\r\n\r\nSecurity Fix(es):\r\n\r\nQt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.(CVE-2023-45935)\r\n\r\nAn issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.(CVE-2024-25580)","status":"published","published":"2024-05-10T11:06:59Z","modified":"2026-08-18T01:18:25.307309427Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-2572","title":"qt6-qtbase security update","description":"Qt is a software toolkit for developing applications.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2023-45935)\r\n\r\n(CVE-2024-25580)\r\n\r\n(CVE-2024-33861)\r\n\r\n(CVE-2024-39936)","status":"published","published":"2024-12-20T11:08:03Z","modified":"2026-08-18T01:17:43.985132821Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"CVE-2023-45935","description":"Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.","status":"published","published":"2024-03-27T05:15:47Z","modified":"2026-04-10T05:01:44.970289Z","updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"OESA-2024-1537","title":"qt5-qtbase security update","description":"This package provides base tools, such as string, xml, and network handling.\r\n\r\nSecurity Fix(es):\r\n\r\nQt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.(CVE-2023-45935)","status":"published","published":"2024-05-10T11:06:58Z","modified":"2026-08-06T11:06:58Z","updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1539","title":"qt5-qtbase security update","description":"This package provides base tools, such as string, xml, and network handling.\r\n\r\nSecurity Fix(es):\r\n\r\nQt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.(CVE-2023-45935)","status":"published","published":"2024-05-10T11:06:59Z","modified":"2026-08-06T11:06:59Z","updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1540","title":"qt5-qtbase security update","description":"This package provides base tools, such as string, xml, and network handling.\r\n\r\nSecurity Fix(es):\r\n\r\nQt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.(CVE-2023-45935)","status":"published","published":"2024-05-10T11:06:59Z","modified":"2026-08-06T11:06:59Z","updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1614","title":"qt5-qtbase security update","description":"This package provides base tools, such as string, xml, and network handling.\r\n\r\nSecurity Fix(es):\r\n\r\nQt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.(CVE-2023-45935)","status":"published","published":"2024-05-17T11:07:04Z","modified":"2026-08-06T11:07:04Z","updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"SUSE-SU-2024:2873-1","title":"Security update for qt6-base","description":"This update for qt6-base fixes the following issues:\n\n- CVE-2024-33861: Fixed an invalid pointer being passed as a callback which coud lead to modification of the stack (bsc#1223917)\n- CVE-2024-39936: Fixed information leakage due to process HTTP2 communication before encrypted() can be responded to (bsc#1227426)\n- CVE-2023-45935: Fixed NULL pointer dereference in QXcbConnection::initializeAllAtoms() due to anomalous behavior from the X server (bsc#1222120)\n","status":"published","published":"2024-08-12T08:03:19Z","modified":"2026-02-04T02:41:51.333721Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2882-1","title":"Security update for libqt5-qtbase","description":"This update for libqt5-qtbase fixes the following issues:\n\n- CVE-2023-45935: Fixed NULL pointer dereference in QXcbConnection::initializeAllAtoms() due to anomalous behavior from the X server (bsc#1222120)\n- CVE-2024-39936: Fixed information leakage due to process HTTP2 communication before encrypted() can be responded to (bsc#1227426)\n","status":"published","published":"2024-08-12T15:40:48Z","modified":"2026-02-04T03:13:53.222301Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2883-1","title":"Security update for libqt5-qtbase","description":"This update for libqt5-qtbase fixes the following issues:\n\n- CVE-2023-45935: Fixed NULL pointer dereference in QXcbConnection::initializeAllAtoms() due to anomalous behavior from the X server (bsc#1222120)\n- CVE-2024-39936: Fixed information leakage due to process HTTP2 communication before encrypted() can be responded to (bsc#1227426)\n","status":"published","published":"2024-08-12T15:41:26Z","modified":"2026-02-04T02:52:34.625568Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2890-1","title":"Security update for libqt5-qtbase","description":"This update for libqt5-qtbase fixes the following issues:\n\n- CVE-2023-51714: Fixed an incorrect integer overflow check (bsc#1218413).\n- CVE-2024-39936: Fixed information leakage due to process HTTP2 communication before encrypted() can be responded to (bsc#1227426)\n- CVE-2023-45935: Fixed NULL pointer dereference in QXcbConnection::initializeAllAtoms() due to anomalous behavior from the X server (bsc#1222120)\n   \nOther fixes:\n  - Add patch from upstream to fix a regression in the ODBC driver (bsc#1227513, QTBUG-112375)\n  - Add upstream patch to fix a potential overflow in assemble_hpack_block()\n","status":"published","published":"2024-08-13T09:38:11Z","modified":"2026-02-04T03:29:21.296511Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2946-1","title":"Security update for libqt5-qtbase","description":"This update for libqt5-qtbase fixes the following issues:\n\n- CVE-2023-37369: Fixed a buffer overflow in QXmlStreamReader (QTBUG-91889, bsc#1214327).\n- CVE-2023-45935: Fixed NULL pointer dereference in QXcbConnection::initializeAllAtoms() due to anomalous behavior from the X server (bsc#1222120)\n- CVE-2024-39936: Fixed information leakage due to process HTTP2 communication before encrypted() can be responded to (bsc#1227426)\n- CVE-2023-51714: Fixed an incorrect integer overflow check (bsc#1218413).\n   \nOther fixes:\n  - Add patch from upstream to fix a regression in the ODBC driver (bsc#1227513, QTBUG-112375)\n  - Add upstream patch to fix a potential overflow in assemble_hpack_block()\n  - Use pkgconfig(icu-18n) to select current icu\n","status":"published","published":"2024-08-16T11:09:20Z","modified":"2026-02-04T03:17:47.464818Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}