Skip to main content

Security advisory: Qt SVG

Comments

A recent potential divide by zero in Qt SVG has been reported and has been assigned the CVE id CVE-2023-32573.

In QSvgFont, the m_unitsPerEm variable initialization is mishandled so if a SVG file that uses font-face without units-per-em set is passed to QSvgRenderer to render then it can trigger a division by zero.

Solution: Apply the following patch or update to Qt 5.15.14, Qt 6.2.9 or Qt 6.5.1

Patches:

dev: https://codereview.qt-project.org/c/qt/qtsvg/+/474093
Qt 6.5: https://codereview.qt-project.org/c/qt/qtsvg/+/474404 or https://download.qt.io/official_releases/qt/6.5/CVE-2023-32573-qtsvg-6.5.diff
Qt 6.2: https://download.qt.io/official_releases/qt/6.2/CVE-2023-32573-qtsvg-6.2.diff
Qt 5.15: https://download.qt.io/official_releases/qt/5.15/CVE-2023-32573-qtsvg-5.15.diff

Comments

Subscribe to our blog

Try Qt 6.10 Now!

Download the latest release here: www.qt.io/download

Qt 6.10 is now available, with new features and improvements for application developers and device creators.

We're Hiring

Check out all our open positions here and follow us on Instagram to see what it's like to be #QtPeople.