An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-02ccd4daed advisory.

    Update to qt-5.15.12.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-350e1aaa3c advisory.

    Update to 6.6.2.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3056 advisory.

    - Fix CVE-2024-25580: potential buffer overflow when reading KTX images       Resolves: RHEL-25725

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3056 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: incorrect integer overflow check (CVE-2023-51714)

    * qtbase: potential buffer overflow when reading KTX images (CVE-2024-25580)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3056 advisory.

  - An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through     6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack     integer overflow check. (CVE-2023-51714)

  - An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through     6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a     crafted KTX image file. (CVE-2024-25580)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2276 advisory.

    - Fix CVE-2024-25580: potential buffer overflow when reading KTX images       Resolves: RHEL-25726

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2276 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: incorrect integer overflow check (CVE-2023-51714)

    * qtbase: potential buffer overflow when reading KTX images (CVE-2024-25580)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-7f2064f068 advisory.

    Update to qt-6.6.2.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-58c67dbb21 advisory.

    Update to qt-5.15.12.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-a8cdce27ac advisory.

    Update to qt-5.15.12.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-d9be3edddb advisory.

    Fix  CVE-2024-25580: potential buffer overflow when reading KTX images.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211349	Fedora 41 : mingw-qt5-qt3d / mingw-qt5-qtactiveqt / mingw-qt5-qtbase / etc (2024-02ccd4daed)	Nessus	Fedora Local Security Checks	medium
211073	Fedora 41 : mingw-qt6-qt3d / mingw-qt6-qt5compat / mingw-qt6-qtactiveqt / etc (2024-350e1aaa3c)	Nessus	Fedora Local Security Checks	medium
198004	Oracle Linux 8 : qt5-qtbase (ELSA-2024-3056)	Nessus	Oracle Linux Local Security Checks	critical
197800	RHEL 8 : qt5-qtbase (RHSA-2024:3056)	Nessus	Red Hat Local Security Checks	critical
197652	CentOS 8 : qt5-qtbase (CESA-2024:3056)	Nessus	CentOS Local Security Checks	critical
195054	Oracle Linux 9 : qt5-qtbase (ELSA-2024-2276)	Nessus	Oracle Linux Local Security Checks	critical
194763	RHEL 9 : qt5-qtbase (RHSA-2024:2276)	Nessus	Red Hat Local Security Checks	critical
194703	Fedora 40 : mingw-qt6-qt3d / mingw-qt6-qt5compat / mingw-qt6-qtactiveqt / etc (2024-7f2064f068)	Nessus	Fedora Local Security Checks	medium
194675	Fedora 40 : mingw-qt5-qt3d / mingw-qt5-qtactiveqt / mingw-qt5-qtbase / etc (2024-58c67dbb21)	Nessus	Fedora Local Security Checks	medium
190953	Fedora 39 : mingw-qt5-qt3d / mingw-qt5-qtactiveqt / mingw-qt5-qtbase / etc (2024-a8cdce27ac)	Nessus	Fedora Local Security Checks	medium
190662	Fedora 39 : qt5-qtbase (2024-d9be3edddb)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2024-25580

medium

Tenable Plugins

medium

medium

critical

critical

critical

critical

critical

medium

medium

medium

medium