Description

In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length.

Related CPE's

a

qt

qt

3

o

debian

debian_linux

10.0

Vulnerable

References

https://bugreports.qt.io/browse/QTBUG-114829

Exploit

https://codereview.qt-project.org/c/qt/qtbase/+/455027

Patch

https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3JR3N3IF5MUSETGYE46OZFOGGPY3VZT/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZK7EDD4ILPPSQAYO54FANUC4NFYLTHU/

Weaknesses

[email protected]

Primary
NVD-CWE-noinfo

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 · High

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Modified

Published

2023-08-20T07:15:08.963

1 year ago

Last modified

2024-05-01T01:15:06.160

8 months ago