Skip to main content

Security advisory: QXmlStreamReader

Jul 18, 2023

by Andy Shaw
Comments

A recently reported potential buffer overflow issue in QXmlStreamReader has been assigned the CVE id CVE-2023-38197.

QXmlStreamReader can freeze or get out of memory on recursive entity expansion, with DTD tokens in XML body.

Solution: Apply the attached patch or update to Qt 5.15.15, Qt 6.2.10, or Qt 6.5.3. Note that the previous security advisory patch for QXmlStreamReader needs to be applied previously in addition before applying this one.

Patches:
dev: https://codereview.qt-project.org/c/qt/qtbase/+/488960
Qt 6.5: https://codereview.qt-project.org/c/qt/qtbase/+/490550 or https://download.qt.io/official_releases/qt/6.5/CVE-2023-38197-qtbase-6.5.diff
Qt 6.2: https://download.qt.io/official_releases/qt/6.2/CVE-2023-38197-qtbase-6.2.diff
Qt 5.15: https://download.qt.io/official_releases/qt/5.15/CVE-2023-38197-qtbase-5.15.diff

Blog Topics

Comments

Subscribe to our blog

Try Qt 6.10 Now!

Download the latest release here: www.qt.io/download

Qt 6.10 is now available, with new features and improvements for application developers and device creators.

We're Hiring

Check out all our open positions here and follow us on Instagram to see what it's like to be #QtPeople.

Related Articles

Security advisory: Recently reported dr_wav issue impacts Qt

Security advisory: Recently reported dr_wav issue impacts Qt

A recently reported issue regarding the loading of specifically crafted..

Read Article
Qt Quick Certification Tests Published

Qt Quick Certification Tests Published

In 2025, we launched the Qt Certification Testing Platform with the Qt..

Read Article
Congratulations Qt Champions 2025!

Congratulations Qt Champions 2025!

Through the Qt Project, both The Qt Group and a global community of..

Read Article