NVD

Id
47042  
Name
CVE-2012-6093  
Description
The QSslSocket::sslErrors function in Qt before 4.6.5, 4.7.x before 4.7.6, 4.8.x before 4.8.5, when using certain versions of openSSL, uses an "incompatible structure layout" that can read memory from the wrong location, which causes Qt to report an incorrect error when certificate validation fails and might cause users to make unsafe security decisions to accept a certificate.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2013-02-24  
Modified Date
2013-02-25  
Seq
2012-6093  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
235597 47042 CVE-2012-6093 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=697582  View
235598 47042 CVE-2012-6093 openSUSE-SU-2013:0204  View
235599 47042 CVE-2012-6093 openSUSE-SU-2013:0211  View
235600 47042 CVE-2012-6093 openSUSE-SU-2013:0256  View
235601 47042 CVE-2012-6093 [Announce] 20130102 Qt Project Security Advisory: QSslSocket may report incorrect errors when certificate verification fails  View
235602 47042 CVE-2012-6093 http://qt.gitorious.org/qt/qt/commit/3b14dc93cf0ef06f1424d7d6319a1af4505faa53%20%284.7%29  View
235603 47042 CVE-2012-6093 http://qt.gitorious.org/qt/qt/commit/691e78e5061d4cbc0de212d23b06c5dffddf2098%20%284.8%29  View
235604 47042 CVE-2012-6093 [oss-security] 20130104 Re: CVE Request -- qt: QSslSocket might report inappropriate errors when certificate verification fails  View
235605 47042 CVE-2012-6093 USN-1723-1  View
235606 47042 CVE-2012-6093 https://bugzilla.redhat.com/show_bug.cgi?id=891955  View
235607 47042 CVE-2012-6093 https://codereview.qt-project.org/#change,42461  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
30244 JVNDB-2012-005951 Qt の QSslSocket::sslErrors 関数における誤ったエラーを報告される脆弱性 Qt の QSslSocket::sslErrors 関数は、openSSL の特定のバージョンを使用している場合、間違ったロケーションからメモリを読むことができる "互換性のない構造のレイアウト (incompatible structure layout)" を使用するため、証明書の検証が失敗した場合に Qt が誤ったエラーを報告し、ユーザが証明書を受け入れてしまう危険なセキュリティ上の意思決定を行う原因となる脆弱性が存在します。 CVE-2012-6093 59331 CVE-2012-6093 47042 4.3 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-005951.html 2012-12-12 2013-02-27 View