The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2982-1 advisory.

  - Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used     and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x     before 6.4.3. (CVE-2023-24607)

  - An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt     Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections     to be established, even when explicitly prohibited by the server. This happens if the case used for this     header does not exactly match. (CVE-2023-32762)

  - An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When     a SVG file with an image inside it is rendered, a QTextLayout buffer overflow can be triggered.
    (CVE-2023-32763)

  - An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1.
    QDnsLookup has a buffer over-read via a crafted reply from a DNS server. (CVE-2023-33285)

  - An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2.
    Certificate validation for TLS does not always consider whether the root of a chain is a configured CA     certificate. (CVE-2023-34410)

  - An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3.
    There are infinite loops in recursive entity expansion. (CVE-2023-38197)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3018-1 advisory.

  - Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used     and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x     before 6.4.3. (CVE-2023-24607)

  - An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt     Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections     to be established, even when explicitly prohibited by the server. This happens if the case used for this     header does not exactly match. (CVE-2023-32762)

  - An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1.
    QDnsLookup has a buffer over-read via a crafted reply from a DNS server. (CVE-2023-33285)

  - An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2.
    Certificate validation for TLS does not always consider whether the root of a chain is a configured CA     certificate. (CVE-2023-34410)

  - An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3.
    There are infinite loops in recursive entity expansion. (CVE-2023-38197)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3225-1 advisory.

  - Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used     and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x     before 6.4.3. (CVE-2023-24607)

  - An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt     Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections     to be established, even when explicitly prohibited by the server. This happens if the case used for this     header does not exactly match. (CVE-2023-32762)

  - An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1.
    QDnsLookup has a buffer over-read via a crafted reply from a DNS server. (CVE-2023-33285)

  - An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2.
    Certificate validation for TLS does not always consider whether the root of a chain is a configured CA     certificate. (CVE-2023-34410)

  - An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3.
    There are infinite loops in recursive entity expansion. (CVE-2023-38197)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7780-1 advisory.

    It was discovered that Qt did not correctly handle certain inputs when using the SQL ODBC driver plugin.
    An attacker could possibly use this issue to cause a denial of service. (CVE-2023-24607)

    It was discovered that Qt did not correctly parse certain strict-transport- security headers. An attacker     could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 20.04 LTS and     Ubuntu 22.04 LTS. (CVE-2023-32762)

    It was discovered that Qt did not correctly handle certain inputs from DNS servers. A remote attacker     could possibly use this issue to execute arbitrary code or cause a denial of service. (CVE-2023-33285)

    It was discovered that Qt did not correctly validate certain CA certificates for TLS. An attacker could     possibly use this issue to gain access to unauthorized resources. (CVE-2023-34410)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2971-1 advisory.

  - Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used     and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x     before 6.4.3. (CVE-2023-24607)

  - An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1.
    QDnsLookup has a buffer over-read via a crafted reply from a DNS server. (CVE-2023-33285)

  - An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2.
    Certificate validation for TLS does not always consider whether the root of a chain is a configured CA     certificate. (CVE-2023-34410)

  - An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3.
    There are infinite loops in recursive entity expansion. (CVE-2023-38197)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3207-1 advisory.

  - Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used     and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x     before 6.4.3. (CVE-2023-24607)

  - An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt     Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections     to be established, even when explicitly prohibited by the server. This happens if the case used for this     header does not exactly match. (CVE-2023-32762)

  - An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1.
    QDnsLookup has a buffer over-read via a crafted reply from a DNS server. (CVE-2023-33285)

  - An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2.
    Certificate validation for TLS does not always consider whether the root of a chain is a configured CA     certificate. (CVE-2023-34410)

  - An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3.
    There are infinite loops in recursive entity expansion. (CVE-2023-38197)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3805 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3805-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     May 01, 2024                                  https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : qtbase-opensource-src     Version        : 5.11.3+dfsg1-1+deb10u6     CVE ID         : CVE-2023-24607 CVE-2023-32762 CVE-2023-32763                      CVE-2023-33285 CVE-2023-37369 CVE-2023-38197                      CVE-2023-51714


    Several issues have been found in qtbase-opensource-src, a collection of     several Qt modules/libraries.
    The issues are related to buffer overflows, infinite loops or application     crashs due to processing of crafted input files.



    For Debian 10 buster, these problems have been fixed in version     5.11.3+dfsg1-1+deb10u6.

    We recommend that you upgrade your qtbase-opensource-src packages.

    For the detailed security status of qtbase-opensource-src please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/qtbase-opensource-src

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:1567-1 advisory.

  - Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used     and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x     before 6.4.3. (CVE-2023-24607)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2036 advisory.

    When using the Qt SQL ODBC driver plugin, then it is possible to trigger a DOS with a specifically crafted     string

    RESERVEDNOTE: https://www.qt.io/blog/security-advisory-qt-sql-odbc-driver-pluginNOTE:
    https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02d (6.4)NOTE:
    https://download.qt.io/official_releases/qt/5.15/CVE-2023-24607-qtbase-5.15.diff (CVE-2023-24607)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used     and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x     before 6.4.3. (CVE-2023-24607)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1096 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-33285:
    Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used     and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x     before 6.4.3.

    CVE-2023-32763:
    An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2.
    Certificate validation for TLS does not always consider whether the root of a chain is a configured CA     certificate.

    CVE-2023-32573:
    An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1.
    QDnsLookup has a buffer over-read via a crafted reply from a DNS server.

    CVE-2023-24607:
    An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When     a SVG file with an image inside it is rendered, a QTextLayout buffer overflow can be triggered.

    CVE-2023-34410:
    An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt     Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections     to be established, even when explicitly prohibited by the server. This happens if the case used for this     header does not exactly match.

    CVE-2023-32762:
    In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg     QSvgFont m_unitsPerEm initialization is mishandled.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
178929	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libqt5-qtbase (SUSE-SU-2023:2982-1)	Nessus	SuSE Local Security Checks	7/27/2023	7/27/2023	medium
179031	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libqt5-qtbase (SUSE-SU-2023:3018-1)	Nessus	SuSE Local Security Checks	7/29/2023	7/29/2023	medium
179593	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : qt6-base (SUSE-SU-2023:3225-1)	Nessus	SuSE Local Security Checks	8/9/2023	8/9/2023	medium
266307	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : Qt vulnerabilities (USN-7780-1)	Nessus	Ubuntu Local Security Checks	9/30/2025	9/30/2025	medium
178923	SUSE SLES12 Security Update : libqt5-qtbase (SUSE-SU-2023:2971-1)	Nessus	SuSE Local Security Checks	7/27/2023	7/27/2023	medium
179429	SUSE SLES15 Security Update : libqt5-qtbase (SUSE-SU-2023:3207-1)	Nessus	SuSE Local Security Checks	8/8/2023	8/8/2023	medium
194883	Debian dla-3805 : libqt5concurrent5 - security update	Nessus	Debian Local Security Checks	5/1/2024	1/22/2025	critical
173408	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : qt6-base (SUSE-SU-2023:1567-1)	Nessus	SuSE Local Security Checks	3/25/2023	7/14/2023	high
175968	Amazon Linux 2 : qt5-qtbase (ALAS-2023-2036)	Nessus	Amazon Linux Local Security Checks	5/17/2023	12/11/2024	high
226591	Linux Distros Unpatched Vulnerability : CVE-2023-24607	Nessus	Misc.	3/5/2025	4/29/2026	high
238774	TencentOS Server 4: qt5-qtbase (TSSA-2024:1096)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

critical

high

high

high

medium