Dangling Pointer Vulnerability in Qt Before 6.5.6 and 6.6.x Before 6.6.3
CVE-2024-30161

6.5MEDIUM

Key Information:

Vendor

Qt

Status
Qt
Vendor
CVE Published:
24 March 2024

What is CVE-2024-30161?

In specific versions of Qt for WebAssembly, the QNetworkReply component has a vulnerability that allows for the potential access of header data through a dangling pointer. This can occur due to improper handling of memory during operations within the affected versions. Such a flaw can result in exposure to sensitive information or unauthorized manipulation of data, elevating the risk of further attacks. It is crucial for users of these versions to implement patches or upgrades to secure their applications against this memory management issue.

References

https://codereview.qt-project.org/c/qt/qtbase/+/544314

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.