Skip to content
Fencer Vulns
high 7.5

CVE-2023-24607 json

Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4.

published 2023-04-15 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-28622

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 71%
public exploits
0
none known

Summary

Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3.

Patch / fix

  • qt qt 5.15.13, 6.2.8, 6.4.3
  • qt6-base Debian 14, Debian 13, Debian 12 6.4.2+dfsg-7
  • qtbase-opensource-src Debian 14, Debian 13, Debian 12 5.15.8+dfsg-3

debian advisories DEBIAN-CVE-2023-24607

  • qtbase-opensource-src Ubuntu Pro 16.04 LTS 5.5.1+dfsg-16ubuntu7.7+esm1
  • qtbase-opensource-src Ubuntu Pro 18.04 LTS 5.9.5+dfsg-0ubuntu2.6+esm1
  • qtbase-opensource-src Ubuntu Pro 20.04 LTS 5.12.8+dfsg-0ubuntu2.1+esm1
  • qtbase-opensource-src Ubuntu Pro 22.04 LTS 5.15.3+dfsg-2ubuntu0.2+esm1

ubuntu advisories UBUNTU-CVE-2023-24607

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • qt6-base SLE Module for Package Hub 15 SP5, SLE Module for Desktop Applications 15 SP5, openSUSE Leap 15.5 6.4.2-150500.3.7.4
  • libqt5-qtbase SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +8 more 5.12.7-150200.4.23.1
  • libqt5-qtbase SLE Module for Desktop Applications 15 SP5, SLE Module for Basesystem 15 SP5, openSUSE Leap 15.5 5.15.8+kde185-150500.4.8.1
  • libqt5-qtbase SLE Module for Desktop Applications 15 SP4, SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 5.15.2+kde294-150400.6.6.1
  • libqt5-qtbase SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 5.6.2-6.36.1
  • qt6-base SLE Module for Package Hub 15 SP4, openSUSE Leap 15.4 6.2.2-150400.4.3.1

suse advisories SUSE-SU-2023:3225-1SUSE-SU-2023:3207-1SUSE-SU-2023:3018-1SUSE-SU-2023:2982-1SUSE-SU-2023:2971-1SUSE-SU-2023:1567-1

  • qt6-base openSUSE Tumbleweed 6.4.2-2.1
  • libqt5-qtbase openSUSE Tumbleweed 5.15.8+kde183-1.1

opensuse advisories openSUSE-SU-2024:12673-1openSUSE-SU-2024:12801-1

  • qt5-qtbase CBL-Mariner 2.0 5.15.9-1

azure linux advisories AZL-26048

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-24607 updated cvss 7.5

qt5: A possible DOS involving the Qt SQL ODBC driver plugin

  • Red Hat Enterprise Linux 8 qt5, qt5-rpm-macros, qt5-srpm-macros Red Hat Enterprise Linux 9 qt5, qt5-rpm-macros, qt5-srpm-macros
    affected: no fix available

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.32% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.