Back to Database
Status published
Medium
CVE-2012-5624
The XMLHttpRequest object in Qt before 4.8.4 enables http redirection...
Vulnerability Description
The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-the-middle attackers to force the read of arbitrary local files and possibly obtain sensitive information via a file: URL to a QML application.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2012-5624
Credits & Attribution
No credits recorded in the NVD database.
References
- http://lists.opensuse.org/opensuse-updates/2013-01/msg00048.html
- http://www.ubuntu.com/usn/USN-1723-1
- http://secunia.com/advisories/52217
- http://qt.gitorious.org/qt/qt/commit/96311def2466dd44de64d77a1c815b22fbf68f71
- http://www.openwall.com/lists/oss-security/2012/12/04/8
- https://codereview.qt-project.org/#change%2C40034
- http://lists.qt-project.org/pipermail/announce/2012-November/000014.html
- http://lists.opensuse.org/opensuse-updates/2013-01/msg00045.html
- http://lists.opensuse.org/opensuse-updates/2013-01/msg00034.html
- https://bugzilla.redhat.com/show_bug.cgi?id=883415
More from digia
View All →CVE-2015-1858
Multiple buffer overflows in gui/image/qbmphandler.cpp in the QtBase module in...
Medium
6.8
CVE-2013-4549
QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause...
Medium
5
CVE-2010-5076
QSslSocket in Qt before 4.7.0-rc1 recognizes a wildcard IP address...
Medium
4.3
CVE-2010-2621
The QSslSocketBackendPrivate::transmit function in src_network_ssl_qsslsocket_openssl.cpp in Qt 4.6.3 and earlier...
Medium
5
CVE-2010-1766
Off-by-one error in the WebSocketHandshake::readServerHandshake function in websockets/WebSocketHandshake.cpp in WebCore...
High
7.5
Affected Vendor
digia
View all reports →Affected Software
qt, ubuntu linux
Vulnerable Versions:
0, 1.41, 1.42, 1.43, 1.44, 1.45, 2.0.0, 2.0.1, 2.0.2, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 4.0.0, 4.0.1, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.2.0, 4.2.1, 4.2.3, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.6.0, 4.6.1, 4.6.2, 4.6.3, 4.6.4, 4.6.5, 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4, 4.7.5, 4.7.6, 4.8.0, 4.8.1, 4.8.2, 10.04, 11.10, 12.04, 12.10
Timeline
Official Publish:
February 24th, 2013
Last Modified:
September 16th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.