TI-2023-16447 Aliases CVE-2023-33285 GHSA-pwf5-mq6w-f36v

An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through…

LOW 32CWE-125Published 2023-05-22 · Updated 2025-01-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. QDnsLookup has a buffer over-read via a crafted reply from a DNS server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00812 57th percentileScored 2026-11-07

Fix Fixed Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:qt:qt::::::::	5.0.0 to before 5.15.4; 6.0.0 to before 6.2.9; 6.3.0 to before 6.5.1	Vulnerable	qt

cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:* Versions 5.0.0 to before 5.15.4; 6.0.0 to before 6.2.9; 6.3.0 to before 6.5.1 Vulnerable ·qt

Remediation

Red Hat 2 advisories

RHSA-2023:6967 Released 2023-11-14 · Red Hat rating Moderate
qt5-qtbase security update
- Red Hat CodeReady Linux Builder (v. 8) qt5-qtbase-static-5.15.3-5.el8
- Red Hat Enterprise Linux AppStream (v. 8) qt5-qtbase-5.15.3-5.el8, qt5-qtbase-common-5.15.3-5.el8, qt5-qtbase-devel-5.15.3-5.el8 +6
RHSA-2023:6369 Released 2023-11-07 · Red Hat rating Moderate
qt5 security and bug fix update
- Red Hat CodeReady Linux Builder (v. 9) qt5-devel-5.15.9-1.el9, qt5-qtbase-static-5.15.9-7.el9
- Red Hat Enterprise Linux AppStream (v. 9) qt5-5.15.9-1.el9, qt5-qtbase-5.15.9-7.el9, qt5-qtbase-common-5.15.9-7.el9 +9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat CodeReady Linux Builder (v. 8)	Fixed	RHSA-2023:6967
Red Hat CodeReady Linux Builder (v. 9)	Fixed	RHSA-2023:6369
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2023:6967
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2023:6369

Not affected: 4 products

Red Hat CodeReady Linux Builder (v. 9)
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux AppStream (v. 9)

Timeline

2026-10-02 Threatist record created from CVE-2023-33285
2026-10-03 Alias added: GHSA-pwf5-mq6w-f36v

References

Advisory 1

https://codereview.qt-project.org/c/qt/qtbase/+/477644

Other 1

[debian-lts-announce] 20240430 [SECURITY] [DLA 3805-1] qtbase-opensource-src security update

TI-2024-23902 QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x… CVSS 3.1CRITICAL 9.8
TI-2022-21359 Heap-based buffer overflow in Qt CVSS 3.1HIGH 8.8
TI-2022-19524 Integer overflow in Qt CVSS 3.1HIGH 8.8
TI-2023-18997 In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can… CVSS 3.1HIGH 7.5
TI-2021-09305 Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0… CVSS 3.1MEDIUM 5.5
TI-2023-28356 An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before… CVSS 3.1CRITICAL 9.8

See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences