CVE-2012-5624
N/A
Published: February 24, 2013 at 07:00 PM UTC
Updated: June 16, 2026 at 11:47 PM UTC
3 products affected across 3 vendorsUbuntu LinuxQtQt
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 2%
Description
The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-the-middle attackers to force the read of arbitrary local files and possibly obtain sensitive information via a file: URL to a QML application.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Ubuntu Linux· Canonicalrubygems
95%1.411.421.431.441.452.0.02.0.12.0.23.3.03.3.13.3.23.3.33.3.43.3.53.3.64.0.04.0.14.1.04.1.14.1.24.1.34.1.44.1.54.2.04.2.14.2.34.3.04.3.14.3.24.3.34.3.44.3.54.4.04.4.14.4.24.4.34.5.04.5.14.5.24.5.34.6.04.6.0 rc14.6.14.6.24.6.34.6.44.6.54.6.5 rc4.7.04.7.14.7.24.7.34.7.44.7.54.7.64.7.6 rc4.8.04.8.14.8.2
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (10)
Vendor Advisoryx_refsource_SUSE
Source: [email protected]
http://lists.opensuse.org/opensuse-updates/2013-01/msg00034.htmlVendor Advisoryx_refsource_SUSE
Source: [email protected]
http://lists.opensuse.org/opensuse-updates/2013-01/msg00045.htmlVendor Advisoryx_refsource_SUSE
Source: [email protected]
http://lists.opensuse.org/opensuse-updates/2013-01/msg00048.htmlMailing Listx_refsource_MLIST
Source: [email protected]
http://lists.qt-project.org/pipermail/announce/2012-November/000014.htmlx_refsource_CONFIRM
Source: [email protected]
http://qt.gitorious.org/qt/qt/commit/96311def2466dd44de64d77a1c815b22fbf68f71Third Party Advisoryx_refsource_SECUNIAVendor Advisory
Source: [email protected]
http://secunia.com/advisories/52217Mailing Listx_refsource_MLIST
Source: [email protected]
http://www.openwall.com/lists/oss-security/2012/12/04/8Quick Info
StatusMODIFIED
CWE
CWE-200
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card