[Development] [Announce] Security advisory: Qt SVG

[List for announcements regarding Qt releases and development via Announce]

A recent buffer overflow issue in Qt SVG has been reported and has been assigned the CVE id CVE-2023-32763.

This effects all Qt versions up to and including Qt 5.15.14, Qt 6.0.0->6.2.8 and Qt 6.3.0->6.5.0

When a SVG file with an image inside it is rendered, a QTextLayout overflow can be triggered.

Solution: Apply the following patch or update to Qt 5.15.15, Qt 6.2.9 or Qt 6.5.1

Patches:

dev: https://codereview.qt-project.org/c/qt/qtbase/+/476125
Qt 6.5: https://codereview.qt-project.org/c/qt/qtbase/+/476490 or https://download.qt.io/official_releases/qt/6.5/CVE-2023-32763-qtbase-6.5.diff
Qt 6.2: https://download.qt.io/official_releases/qt/6.2/CVE-2023-32763-qtbase-6.2.diff
Qt 5.15: https://download.qt.io/official_releases/qt/5.15/CVE-2023-32763-qtbase-5.15.diff

Kind regards,
Andy
--
Andy Shaw
Director, Technical Customer Success 
The Qt Company

_______________________________________________
Announce mailing list
Announce at qt-project.org
https://lists.qt-project.org/listinfo/announce