Vulnerability · Published Aug 20, 2023 · Assigned by mitre
CVE-2023-37369
High 7.5
In plain English
A high-severity security flaw in the qt5 package (AlmaLinux). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.6%top 24.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | qt5 | 5.15.9-1.el9 | ALSA-2023:6369 |
| AlmaLinux:9 | qt5-devel | 5.15.9-1.el9 | ALSA-2023:6369 |
| AlmaLinux:8 | qt5-qtbase | 5.15.3-5.el8 | ALSA-2023:6967 |
| AlmaLinux:9 | qt5-qtbase | 5.15.9-7.el9 | ALSA-2023:6369 |
| AlmaLinux:8 | qt5-qtbase-common | 5.15.3-5.el8 | ALSA-2023:6967 |
| AlmaLinux:9 | qt5-qtbase-common | 5.15.9-7.el9 | ALSA-2023:6369 |
| AlmaLinux:8 | qt5-qtbase-devel | 5.15.3-5.el8 | ALSA-2023:6967 |
| AlmaLinux:9 | qt5-qtbase-devel | 5.15.9-7.el9 | ALSA-2023:6369 |
| AlmaLinux:8 | qt5-qtbase-examples | 5.15.3-5.el8 | ALSA-2023:6967 |
| AlmaLinux:9 | qt5-qtbase-examples | 5.15.9-7.el9 | ALSA-2023:6369 |
| AlmaLinux:8 | qt5-qtbase-gui | 5.15.3-5.el8 | ALSA-2023:6967 |
| AlmaLinux:9 | qt5-qtbase-gui | 5.15.9-7.el9 | ALSA-2023:6369 |
| AlmaLinux:8 | qt5-qtbase-mysql | 5.15.3-5.el8 | ALSA-2023:6967 |
| AlmaLinux:9 | qt5-qtbase-mysql | 5.15.9-7.el9 | ALSA-2023:6369 |
| AlmaLinux:8 | qt5-qtbase-odbc | 5.15.3-5.el8 | ALSA-2023:6967 |
| AlmaLinux:9 | qt5-qtbase-odbc | 5.15.9-7.el9 | ALSA-2023:6369 |
| AlmaLinux:8 | qt5-qtbase-postgresql | 5.15.3-5.el8 | ALSA-2023:6967 |
| AlmaLinux:9 | qt5-qtbase-postgresql | 5.15.9-7.el9 | ALSA-2023:6369 |
| AlmaLinux:8 | qt5-qtbase-private-devel | 5.15.3-5.el8 | ALSA-2023:6967 |
| AlmaLinux:9 | qt5-qtbase-private-devel | 5.15.9-7.el9 | ALSA-2023:6369 |
| AlmaLinux:8 | qt5-qtbase-static | 5.15.3-5.el8 | ALSA-2023:6967 |
| AlmaLinux:9 | qt5-qtbase-static | 5.15.9-7.el9 | ALSA-2023:6369 |
| AlmaLinux:9 | qt5-rpm-macros | 5.15.9-1.el9 | ALSA-2023:6369 |
| AlmaLinux:9 | qt5-srpm-macros | 5.15.9-1.el9 | ALSA-2023:6369 |
| Debian:12 | qt6-base | no fix listed | DEBIAN-CVE-2023-37369 |
| Debian:13 | qt6-base | 6.4.2+dfsg-20 | DEBIAN-CVE-2023-37369 |
| Debian:14 | qt6-base | 6.4.2+dfsg-20 | DEBIAN-CVE-2023-37369 |
| Debian:12 | qtbase-opensource-src | 5.15.8+dfsg-11+deb12u1 | DEBIAN-CVE-2023-37369 |
| Debian:13 | qtbase-opensource-src | 5.15.10+dfsg-3 | DEBIAN-CVE-2023-37369 |
| Debian:14 | qtbase-opensource-src | 5.15.10+dfsg-3 | DEBIAN-CVE-2023-37369 |
| Debian:12 | qtbase-opensource-src-gles | no fix listed | DEBIAN-CVE-2023-37369 |
| Debian:13 | qtbase-opensource-src-gles | 5.15.10+dfsg-2 | DEBIAN-CVE-2023-37369 |
| Debian:14 | qtbase-opensource-src-gles | 5.15.10+dfsg-2 | DEBIAN-CVE-2023-37369 |
| Rocky Linux:9 | adwaita-qt | 0:1.4.2-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | python-pyqt5-sip | 0:12.11.1-1.el9.0.1 | RLSA-2023:6369 |
| Rocky Linux:9 | python-qt5 | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qgnomeplatform | 0:0.9.0-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5 | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-doc | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtconnectivity | 0:5.15.9-2.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtdeclarative | 0:5.15.9-3.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtdoc | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtgraphicaleffects | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtimageformats | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtlocation | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtmultimedia | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtquickcontrols | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtquickcontrols2 | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtscript | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtsensors | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtserialbus | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtserialport | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtsvg | 0:5.15.9-2.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qttranslations | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtwayland | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtwebchannel | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtwebsockets | 0:5.15.9-2.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtx11extras | 0:5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux:9 | qt5-qtxmlpatterns | 0:5.15.9-2.el9 | RLSA-2023:6369 |
| Ubuntu:22.04:LTS | qt6-base | no fix listed | UBUNTU-CVE-2023-37369 |
| Ubuntu:24.04:LTS | qt6-base | no fix listed | UBUNTU-CVE-2023-37369 |
| Ubuntu:25.10 | qt6-base | no fix listed | UBUNTU-CVE-2023-37369 |
| Ubuntu:26.04:LTS | qt6-base | no fix listed | UBUNTU-CVE-2023-37369 |
| Ubuntu:26.10 | qt6-base | no fix listed | UBUNTU-CVE-2023-37369 |
| Ubuntu:22.04:LTS | qtbase-opensource-src | no fix listed | UBUNTU-CVE-2023-37369 |
| Ubuntu:22.04:LTS | qtbase-opensource-src-gles | no fix listed | UBUNTU-CVE-2023-37369 |
| Ubuntu:24.04:LTS | qtbase-opensource-src-gles | no fix listed | UBUNTU-CVE-2023-37369 |
| Ubuntu:25.10 | qtbase-opensource-src-gles | no fix listed | UBUNTU-CVE-2023-37369 |
| Ubuntu:26.04:LTS | qtbase-opensource-src-gles | no fix listed | UBUNTU-CVE-2023-37369 |
| Ubuntu:26.10 | qtbase-opensource-src-gles | no fix listed | UBUNTU-CVE-2023-37369 |
Affected products (as reported)
References
- https://bugreports.qt.io/browse/QTBUG-114829
- https://codereview.qt-project.org/c/qt/qtbase/+/455027
- [debian-lts-announce] 20230822 [SECURITY] [DLA 3539-1] qt4-x11 security update mailing-list
- FEDORA-2023-0e68827d36 vendor-advisory
- FEDORA-2023-fd45b50121 vendor-advisory
- [debian-lts-announce] 20240430 [SECURITY] [DLA 3805-1] qtbase-opensource-src security update mailing-list