A recently reported potential buffer overflow issue in QXmlStreamReader has been assigned the CVE id CVE-2023-37369
When given specifically crafted data then QXmlStreamReader can end up causing a buffer overflow and subsequently a crash.
Solution: Validate any XML being passed to QXmlStreamReader that is not already trusted. Alternatively apply the attached patch or update to Qt 5.15.15, Qt 6.2.10, or Qt 6.5.2
You do understand that every single patch you released for 5.15 branch is broken, do you?
M
Maurice Kalinowski
0 points
21 months ago
How so?
A
Andy Shaw
0 points
21 months ago
I double-checked this one and it does not apply on top of Qt 5.15.10 which is correct because that does not have an issue, however, to make sure the patch applies for safety's sake. I have updated the patch so it now applies cleanly against Qt 5.15.10.
You do understand that every single patch you released for 5.15 branch is broken, do you?
How so?
I double-checked this one and it does not apply on top of Qt 5.15.10 which is correct because that does not have an issue, however, to make sure the patch applies for safety's sake. I have updated the patch so it now applies cleanly against Qt 5.15.10.