Upgrade for QT dependancies vulnerabilities

[claudiudc]

Good day,
First of all I want you to congratulate for this project, thank you, it is really useful for us.
Please allow me to raise a question, do you believe it would be possible to upgrade the project to target new QT > 6.1.2?
Qt5Script.dll and Qt5Core.dll have this vulnerabilities: CWE-787 CWE-787 Out-of-bounds Write: CVE-2021-38593
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-38593

Thank you.

[horsicq]

Hello! Thanks a lot for the bugreport!
Sure, I will upgrade to 6.xx

[horsicq]

Qt6 does not have qtscript module. I have to rewrite this part of the code.

[horsicq]

Do you need Windows or Linux build?

[claudiudc]

My apologies, I forgot to mention, we use Windows and 32 bits version of your program.
Thank you.

[horsicq]

Do you use console version or GUI?

[claudiudc]

console version

[horsicq]

Ok. I will upgrade to 6.XX anyway. But you do not really need the upgrade if you are using console version. CVE-2021-38593 is about GUI painting(QRasterPaintEngine::fill and QPaintEngineEx::stroke).
BTW Did you try my another project NFD: https://github.com/horsicq/Nauz-File-Detector ?

[claudiudc]

Indeed, the console version does not need it, however we have a scanner at work that is giving this security warning, I will try to see if we can bypass it since we are using console version.
Also thank you for providing info for NFD, I will take a look at it.

[claudiudc]

HI @horsicq
Please forgive me to come with an update to this topic, do you know if there Is any plan to update to new qt by any chance?
On the company where I work on the security policy require to remove qt5 dependencies from the product since our and customer scanning tools are finding qt5 vulnerabilities.
Thank you.

[horsicq]

Hello! The next version of DiE will be with the lastest Qt6 version. I am working on it. it will be in 2-3 monthes.

[claudiudc]

Thank you for updates, really appreciate.

[horsicq]

Qt6 https://github.com/horsicq/DIE-engine/releases/tag/3.04

[claudiudc]

Many thanks, by any chance is possible to release 32 bit version for the one with QT 6 for windows? We are using both 32 and 64 bit windows operating systems.
Thank you.

[horsicq]

There are only 64 versions of Qt6

So I keep using Qt5 for 32 projects.

[claudiudc]

Thank you for info.