CVE-2012-5624

Qt <4.8.4 - Info Disclosure

Title source: llm
STIX 2.1

Description

The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-the-middle attackers to force the read of arbitrary local files and possibly obtain sensitive information via a file: URL to a QML application.

References (10)

Core 10
Core References
Various Sources x_refsource_confirm
https://codereview.qt-project.org/#change%2C40034
Various Sources mailing-list x_refsource_mlist
http://lists.qt-project.org/pipermail/announce/2012-November/000014.html
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-01/msg00048.html
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1723-1
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/52217
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/12/04/8
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-01/msg00045.html
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-01/msg00034.html
Issue Tracking x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=883415

Scores

EPSS 0.0194
EPSS Percentile 77.7%

Details

CWE
CWE-200
Status published
Products (49)
canonical/ubuntu_linux 10.04
canonical/ubuntu_linux 11.10
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 12.10
digia/qt < 4.8.3
qt/qt 1.41
qt/qt 1.42
qt/qt 1.43
qt/qt 1.44
qt/qt 1.45
... and 39 more
Published Feb 24, 2013
Tracked Since Feb 18, 2026