Moderate: qt5 security and bug fix update
Summary
ALSA-2023:6369: Moderate: qt5 security and bug fix update. Affects qt5 versions < 5.15.9-1.el9. Fixed in 5.15.9-1.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Qt is a software toolkit for developing applications. It provides a comprehensive set of tools and libraries for creating cross-platform applications with a consistent user interface. Qt is widely used in various industries, including automotive, medical, and consumer electronics.
Vulnerability Detail
This update addresses multiple security vulnerabilities in the Qt package:
-
CVE-2023-33285: A buffer over-read vulnerability can be exploited by a remote attacker through a crafted reply from a DNS server.
-
CVE-2023-34410: A flaw in certificate validation allows a remote attacker to bypass security restrictions.
-
CVE-2023-37369: A buffer overflow vulnerability exists in QXmlStreamReader.
-
CVE-2023-38197: Infinite loops can occur in QXmlStreamReader.
-
CVE-2023-32573: Uninitialized variable usage in m_unitsPerEm can lead to security issues.
These vulnerabilities could potentially result in remote code execution, information disclosure, or denial of service.
How To Fix
Minimum fixed version
5.15.9-1.el9
This is the first release that contains the fix.
sudo dnf update qt5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This update addresses multiple security vulnerabilities in the Qt package. It is recommended to update the affected packages to the latest version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qt5 →
FAQ
Qt is a software toolkit for developing applications. It provides a comprehensive set of tools and libraries for creating cross-platform applications with a consistent user interface.
These vulnerabilities could potentially result in remote code execution, information disclosure, or denial of service.
To fix these vulnerabilities, it is recommended to update the affected Qt packages to version 5.15.9-1.el9 or later.
No specific workarounds have been provided for these vulnerabilities.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for qt5.
