Andy Shaw reports:
QStringConverter has an invalid pointer being passed as a callback
	    which can allow modification of the stack. Qt itself is not vulnerable
	    to remote attack however an application using QStringDecoder either
	    directly or indirectly can be vulnerable.
This requires:
Qt does not automatically use any of those codecs, so this needs the application
	    to implement something using QStringDecoder to be vulnerable.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2873-1 advisory.

    - CVE-2024-33861: Fixed an invalid pointer being passed as a callback which coud lead to modification of     the stack (bsc#1223917)
    - CVE-2024-39936: Fixed information leakage due to process HTTP2 communication before encrypted() can be     responded to (bsc#1227426)
    - CVE-2023-45935: Fixed NULL pointer dereference in QXcbConnection::initializeAllAtoms() due to anomalous     behavior from the X server (bsc#1222120)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2875-1 advisory.

    - CVE-2024-33861: Fixed an invalid pointer being passed as a callback which coud lead to modification of     the stack (bsc#1223917)
    - CVE-2024-39936: Fixed information leakage due to process HTTP2 communication before encrypted() can be     responded to (bsc#1227426)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e79cc4e2-12d7-11ef-83d8-4ccc6adda413 advisory.

  - Andy Shaw reports: QStringConverter has an invalid pointer being passed as a callback             which     can allow modification of the stack. Qt itself is not vulnerable             to remote attack however an     application using QStringDecoder either             directly or indirectly can be vulnerable. This     requires: Qt does not automatically use any of those codecs, so this needs the application             to     implement something using QStringDecoder to be vulnerable. (CVE-2024-33861)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
205409	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : qt6-base (SUSE-SU-2024:2873-1)	Nessus	SuSE Local Security Checks	medium
205400	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : qt6-base (SUSE-SU-2024:2875-1)	Nessus	SuSE Local Security Checks	medium
197098	FreeBSD : qt6-base (core module) -- Invalid pointer in QStringConverter (e79cc4e2-12d7-11ef-83d8-4ccc6adda413)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2024-33861

medium

Tenable Plugins

medium

medium

critical