ALT-BU-2024-2850-2
Branch sisyphus update bulletin.
Closed vulnerabilities
Modified: 2026-03-18
BDU:2024-10487
Уязвимость декодера JPEG XL библиотеки Libjxl, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2026-03-18
BDU:2024-10890
Уязвимость функции JxlEncoderAddJPEGFrame() декодера JPEG XL библиотеки Libjxl, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-07-24
CVE-2024-11403
There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.
Modified: 2025-07-23
CVE-2024-11498
There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a file that will cause excessive memory usage. We recommend upgrading past commit 65fbec56bc578b6b6ee02a527be70787bbd053b0.
Closed vulnerabilities
Modified: 2026-01-20
BDU:2024-04901
Уязвимость декодера dav1d операционных систем iOS, iPadOS, visionOS, macOS, Fedora, браузера Safari, позволяющая нарушителю выполнить произвольный код
Modified: 2025-02-13
CVE-2024-1580
An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.
- http://seclists.org/fulldisclosure/2024/Mar/36
- http://seclists.org/fulldisclosure/2024/Mar/37
- http://seclists.org/fulldisclosure/2024/Mar/38
- http://seclists.org/fulldisclosure/2024/Mar/39
- http://seclists.org/fulldisclosure/2024/Mar/40
- http://seclists.org/fulldisclosure/2024/Mar/41
- https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS
- https://code.videolan.org/videolan/dav1d/-/releases/1.4.0
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/
- https://support.apple.com/kb/HT214093
- https://support.apple.com/kb/HT214094
- https://support.apple.com/kb/HT214095
- https://support.apple.com/kb/HT214096
- https://support.apple.com/kb/HT214097
- https://support.apple.com/kb/HT214098
- http://seclists.org/fulldisclosure/2024/Mar/36
- http://seclists.org/fulldisclosure/2024/Mar/37
- http://seclists.org/fulldisclosure/2024/Mar/38
- http://seclists.org/fulldisclosure/2024/Mar/39
- http://seclists.org/fulldisclosure/2024/Mar/40
- http://seclists.org/fulldisclosure/2024/Mar/41
- https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS
- https://code.videolan.org/videolan/dav1d/-/releases/1.4.0
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/
- https://support.apple.com/kb/HT214093
- https://support.apple.com/kb/HT214094
- https://support.apple.com/kb/HT214095
- https://support.apple.com/kb/HT214096
- https://support.apple.com/kb/HT214097
- https://support.apple.com/kb/HT214098
Package qt6-shadertools updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-declarative updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-multimedia updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-wayland updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-serialport updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-connectivity updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-remoteobjects updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2023-11-13
BDU:2022-00893
Уязвимость пакета qt/qtbase библиотеки Qt, позволяющая нарушителю выполнить произвольный код
Modified: 2025-09-05
BDU:2023-02373
Уязвимость плагина SQL ODBC кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-05
BDU:2023-03689
Уязвимость кроссплатформенного фреймворка для разработки программного обеспечения Qt, связанная с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю обойти существующие ограничения безопасности
Modified: 2025-09-05
BDU:2023-03802
Уязвимость компонента QTextLayout кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-01-29
BDU:2023-03803
Уязвимость кроссплатформенного фреймворка для разработки программного обеспечения Qt, связанная с передачей защищаемой информации в незашифрованном виде, позволяющая нарушителю оказать воздействие на целостность данных
Modified: 2025-01-29
BDU:2023-03876
Уязвимость компонента QDnsLookup кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-09-05
BDU:2023-05105
Уязвимость функции QXmlStreamReader кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-05
BDU:2023-05106
Уязвимость функции QSvgFont (Qt SVG) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-05109
Уязвимость функции LoadLibrary кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю получить доступ к защищаемой информации
BDU:2023-05913
Уязвимость функции addApplicationFont{FromData] класса QFontDatabase кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-09-05
BDU:2023-09121
Уязвимость функции fastScanName() класса QXmlStreamReader кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-10-29
BDU:2024-09033
Уязвимость кроссплатформенного фреймворка для разработки программного обеспечения Qt, связанная с записью за границами буфера, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-09-05
BDU:2025-00916
Уязвимость функции QOutlineMapper::convertPath кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2021-38593
Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35566
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-903.yaml
- https://github.com/qt/qtbase/commit/1ca02cf2879a5e1511a2f2109f0925cf4c892862
- https://github.com/qt/qtbase/commit/202143ba41f6ac574f1858214ed8bf4a38b73ccd
- https://github.com/qt/qtbase/commit/6b400e3147dcfd8cc3a393ace1bd118c93762e0c
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36VN2WKMNQUSTF6ZW2X52NPAJVXJ4S5I/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HY5YCSDCTLHVMP3OXOM6HNTWHV6DBHDX/
- https://security.gentoo.org/glsa/202402-03
- https://wiki.qt.io/Qt_5.15_Release#Known_Issues
- https://www.qt.io/blog/qt-5.15-extended-support-for-subscription-license-holders
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35566
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-903.yaml
- https://github.com/qt/qtbase/commit/1ca02cf2879a5e1511a2f2109f0925cf4c892862
- https://github.com/qt/qtbase/commit/202143ba41f6ac574f1858214ed8bf4a38b73ccd
- https://github.com/qt/qtbase/commit/6b400e3147dcfd8cc3a393ace1bd118c93762e0c
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36VN2WKMNQUSTF6ZW2X52NPAJVXJ4S5I/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HY5YCSDCTLHVMP3OXOM6HNTWHV6DBHDX/
- https://security.gentoo.org/glsa/202402-03
- https://wiki.qt.io/Qt_5.15_Release#Known_Issues
- https://www.qt.io/blog/qt-5.15-extended-support-for-subscription-license-holders
Modified: 2024-11-21
CVE-2021-45930
Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37025
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37306
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-1121.yaml
- https://github.com/qt/qtsvg/commit/36cfd9efb9b22b891adee9c48d30202289cfa620
- https://github.com/qt/qtsvg/commit/79bb9f51fa374106a612d17c9d98d35d807be670
- https://github.com/qt/qtsvg/commit/a3b753c2d077313fc9eb93af547051b956e383fc
- https://lists.debian.org/debian-lts-announce/2022/01/msg00020.html
- https://lists.debian.org/debian-lts-announce/2022/01/msg00022.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GKOKVCSDZSOWWR3HOW5XUIUJC4MKQY5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GZIXNSX7FV733TWTTLY6FHSH3SCNQKKD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V75XNX4GDB64N5BSOAN474RUXXS5OHRU/
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37025
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37306
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-1121.yaml
- https://github.com/qt/qtsvg/commit/36cfd9efb9b22b891adee9c48d30202289cfa620
- https://github.com/qt/qtsvg/commit/79bb9f51fa374106a612d17c9d98d35d807be670
- https://github.com/qt/qtsvg/commit/a3b753c2d077313fc9eb93af547051b956e383fc
- https://lists.debian.org/debian-lts-announce/2022/01/msg00020.html
- https://lists.debian.org/debian-lts-announce/2022/01/msg00022.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GKOKVCSDZSOWWR3HOW5XUIUJC4MKQY5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GZIXNSX7FV733TWTTLY6FHSH3SCNQKKD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V75XNX4GDB64N5BSOAN474RUXXS5OHRU/
Modified: 2024-11-21
CVE-2022-25255
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
- https://codereview.qt-project.org/c/qt/qtbase/+/393113
- https://codereview.qt-project.org/c/qt/qtbase/+/394914
- https://codereview.qt-project.org/c/qt/qtbase/+/396020
- https://download.qt.io/official_releases/qt/5.15/qprocess5-15.diff
- https://download.qt.io/official_releases/qt/6.2/qprocess6-2.diff
- https://codereview.qt-project.org/c/qt/qtbase/+/393113
- https://codereview.qt-project.org/c/qt/qtbase/+/394914
- https://codereview.qt-project.org/c/qt/qtbase/+/396020
- https://download.qt.io/official_releases/qt/5.15/qprocess5-15.diff
- https://download.qt.io/official_releases/qt/6.2/qprocess6-2.diff
Modified: 2024-11-21
CVE-2022-25634
Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.
- https://codereview.qt-project.org/c/qt/qtbase/+/396440
- https://codereview.qt-project.org/c/qt/qtbase/+/396689
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/396690
- https://download.qt.io/official_releases/qt/5.15/CVE-2022-25643-5.15.diff
- https://download.qt.io/official_releases/qt/6.2/CVE-2022-25643-6.2.diff
- https://codereview.qt-project.org/c/qt/qtbase/+/396440
- https://codereview.qt-project.org/c/qt/qtbase/+/396689
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/396690
- https://download.qt.io/official_releases/qt/5.15/CVE-2022-25643-5.15.diff
- https://download.qt.io/official_releases/qt/6.2/CVE-2022-25643-6.2.diff
Modified: 2024-11-21
CVE-2023-24607
Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3.
- https://codereview.qt-project.org/c/qt/qtbase/+/456216
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456217
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456238
- https://download.qt.io/official_releases/qt/5.15/CVE-2023-24607-qtbase-5.15.diff
- https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02d
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://www.qt.io/blog/security-advisory-qt-sql-odbc-driver-plugin
- https://www.qt.io/blog/tag/security
- https://codereview.qt-project.org/c/qt/qtbase/+/456216
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456217
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456238
- https://download.qt.io/official_releases/qt/5.15/CVE-2023-24607-qtbase-5.15.diff
- https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02d
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://www.qt.io/blog/security-advisory-qt-sql-odbc-driver-plugin
- https://www.qt.io/blog/tag/security
Modified: 2025-01-27
CVE-2023-32573
In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled.
- https://codereview.qt-project.org/c/qt/qtsvg/+/474093
- https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UE3IHQZCEUFVOPWG75V2HDKXNUZBB4FX/
- https://codereview.qt-project.org/c/qt/qtsvg/+/474093
- https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UE3IHQZCEUFVOPWG75V2HDKXNUZBB4FX/
Modified: 2025-03-05
CVE-2023-32762
An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match.
- https://codereview.qt-project.org/c/qt/qtbase/+/476140
- https://github.com/qt/qtbase/commit/1b736a815be0222f4b24289cf17575fc15707305
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://lists.qt-project.org/pipermail/announce/2023-May/000414.html
- https://codereview.qt-project.org/c/qt/qtbase/+/476140
- https://github.com/qt/qtbase/commit/1b736a815be0222f4b24289cf17575fc15707305
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://lists.qt-project.org/pipermail/announce/2023-May/000414.html
Modified: 2024-11-21
CVE-2023-32763
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When a SVG file with an image inside it is rendered, a QTextLayout buffer overflow can be triggered.
- https://codereview.qt-project.org/c/qt/qtbase/+/476125
- https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://lists.qt-project.org/pipermail/announce/2023-May/000413.html
- https://security.gentoo.org/glsa/202402-03
- https://codereview.qt-project.org/c/qt/qtbase/+/476125
- https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://lists.qt-project.org/pipermail/announce/2023-May/000413.html
- https://security.gentoo.org/glsa/202402-03
Modified: 2024-11-21
CVE-2023-33285
An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. QDnsLookup has a buffer over-read via a crafted reply from a DNS server.
Modified: 2025-03-20
CVE-2023-34410
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider whether the root of a chain is a configured CA certificate.
- https://codereview.qt-project.org/c/qt/qtbase/+/477560
- https://codereview.qt-project.org/c/qt/qtbase/+/480002
- https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UE3IHQZCEUFVOPWG75V2HDKXNUZBB4FX/
- https://codereview.qt-project.org/c/qt/qtbase/+/477560
- https://codereview.qt-project.org/c/qt/qtbase/+/480002
- https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UE3IHQZCEUFVOPWG75V2HDKXNUZBB4FX/
Modified: 2024-11-21
CVE-2023-37369
In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length.
- https://bugreports.qt.io/browse/QTBUG-114829
- https://codereview.qt-project.org/c/qt/qtbase/+/455027
- https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3JR3N3IF5MUSETGYE46OZFOGGPY3VZT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZK7EDD4ILPPSQAYO54FANUC4NFYLTHU/
- https://bugreports.qt.io/browse/QTBUG-114829
- https://codereview.qt-project.org/c/qt/qtbase/+/455027
- https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3JR3N3IF5MUSETGYE46OZFOGGPY3VZT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZK7EDD4ILPPSQAYO54FANUC4NFYLTHU/
Modified: 2024-11-21
CVE-2023-38197
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion.
- https://codereview.qt-project.org/c/qt/qtbase/+/488960
- https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F5C3NYVJ73ITE6HUOVVHBUAGORVEJRHO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XEGQ6DFTL2BEJMHCD5FJGI6XLWQI7UEA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFZORZYCMUZZFIOEZICJ7VH2BZIGY3HV/
- https://codereview.qt-project.org/c/qt/qtbase/+/488960
- https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F5C3NYVJ73ITE6HUOVVHBUAGORVEJRHO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XEGQ6DFTL2BEJMHCD5FJGI6XLWQI7UEA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFZORZYCMUZZFIOEZICJ7VH2BZIGY3HV/
Modified: 2024-11-21
CVE-2023-43114
An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupted font is loaded via QFontDatabase::addApplicationFont{FromData], then it can cause the application to crash because of missing length checks.
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-serialbus updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-speech updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-webengine updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-translations updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-5compat updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-webchannel updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-imageformats updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-sensors updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-positioning updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-quicktimeline updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-charts updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-networkauth updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-websockets updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-datavis3d updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package qt6-virtualkeyboard updated to version 6.6.2-alt1 for branch sisyphus in task 341139.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-00093
Уязвимость реализации протокола HTTP2 (network/access/http2/hpacktable.cpp) кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2026-02-16
BDU:2024-02875
Уязвимость компонента gui/util/qktxhandler.cpp модуля обработки изображений KTX кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-51714
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
- https://codereview.qt-project.org/c/qt/qtbase/+/524864
- https://codereview.qt-project.org/c/qt/qtbase/+/524865/3
- https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
Modified: 2025-11-04
CVE-2024-25580
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYE2NMN67DYHYJKLAKLGR64OYI7A63AH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZWTGLKC3WBDHZ5OJRSEB2QUR7XXZDLZV/
- https://www.qt.io/blog/security-advisory-potential-buffer-overflow-when-reading-ktx-images
Package firefox-esr updated to version 115.8.0-alt1 for branch sisyphus in task 341225.
Closed vulnerabilities
Modified: 2024-11-11
BDU:2024-01619
Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с ошибками представления информации пользовательским интерфейсом, позволяющая нарушителю проводить спуфинг-атаки
Modified: 2024-11-11
BDU:2024-01659
Уязвимость полноэкранного режима браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю проводить спуфинг-атаки
Modified: 2024-11-11
BDU:2024-01660
Уязвимость реализации отображения курсора браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю получить произвольные разрешения на веб-сайте без согласия пользователя
Modified: 2025-02-07
BDU:2024-01661
Уязвимость реализации прикладного программного интерфейса браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю отобразить alertdialog на другом веб-сайте
Modified: 2024-11-11
BDU:2024-01662
Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с неверным ограничением визуализируемых слоев или фреймов пользовательского интерфейса, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-11
BDU:2024-01663
Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с неверной нейтрализацией особых элементов в выходных данных, используемых входящим компонентом, позволяющая нарушителю внедрить произвольные HTTP-заголовки
Modified: 2024-09-24
BDU:2024-01664
Уязвимость браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, связанная с неверной нейтрализацией особых элементов в выходных данных, используемых входящим компонентом, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-11
BDU:2024-01815
Уязвимость браузера Mozilla Firefox, Firefox ESR, Thunderbird, связанная с записью за границами буфера, позволяющая нарушителю выполнить произвольный код
Modified: 2025-03-27
CVE-2024-1546
When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memory read. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1843752
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1843752
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
Modified: 2025-03-28
CVE-2024-1547
Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the victim website's URL shown). This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1877879
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1877879
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
Modified: 2025-03-27
CVE-2024-1548
A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1832627
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1832627
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
Modified: 2025-03-27
CVE-2024-1549
If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in user confusion and unexpected granted permissions. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1833814
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1833814
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
Modified: 2025-03-27
CVE-2024-1550
A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1860065
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1860065
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
Modified: 2025-04-02
CVE-2024-1551
Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as control part of the response body, they could inject Set-Cookie response headers that would have been honored by the browser. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1864385
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1864385
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
Modified: 2025-03-27
CVE-2024-1552
Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects 32-bit ARM devices. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1874502
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1874502
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
Modified: 2025-03-27
CVE-2024-1553
Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1855686%2C1867982%2C1871498%2C1872296%2C1873521%2C1873577%2C1873597%2C1873866%2C1874080%2C1874740%2C1875795%2C1875906%2C1876425%2C1878211%2C1878286
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1855686%2C1867982%2C1871498%2C1872296%2C1873521%2C1873577%2C1873597%2C1873866%2C1874080%2C1874740%2C1875795%2C1875906%2C1876425%2C1878211%2C1878286
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
