Correction to the post as I had the wrong URLs for the links to Codereview. The 
correct links are:

dev: https://codereview.qt-project.org/c/qt/qtsvg/+/510674
6.6: https://codereview.qt-project.org/c/qt/qtsvg/+/510692 or 
https://download.qt.io/official_releases/qt/6.6/CVE-2023-45872-qtsvg-6.6.0.diff
6.2: 
https://download.qt.io/official_releases/qt/6.2/CVE-2023-45872-qtsvg-6.2.10.diff

Kind regards,
Andy

-----Original Message-----
From: Development <development-boun...@qt-project.org> On Behalf Of List for 
announcements regarding Qt releases and development via Announce via Development
Sent: Thursday, October 19, 2023 12:00 PM
To: annou...@qt-project.org
Cc: List for announcements regarding Qt releases and development via Announce 
<annou...@qt-project.org>
Subject: [Development] [Announce] Security advisory: Loading invalid QML image 
source impacts Qt

Hi,

An issue when loading an invalid QML image source has been reported and has 
been assigned the CVE id CVE-2023-45872. 

When an invalid source is used to indicate an image to be loaded is specified 
then it will end up trying to load it as a SVG file which will trigger a crash 
in Qt SVG. This does not affect Qt 5.15.x or Qt 6.5.3

Solution: As a workaround, validate that the image source urls are valid 
beforehand. Or apply the following patch or update to Qt 6.2.11, Qt 6.6.1.

Patches:
dev: https://codereview.qt-project.org/c/qt/qtbase/+/503026
6.6: https://codereview.qt-project.org/c/qt/qtbase/+/504234 or 
https://download.qt.io/official_releases/qt/6.6/CVE-2023-45872-qtsvg-6.6.0.diff
6.2: 
https://download.qt.io/official_releases/qt/6.2/CVE-2023-45872-qtsvg-6.2.10.diff

Kind regards,
Andy
--
Andy Shaw
Director, Technical Customer Success 
The Qt Company

_______________________________________________
Announce mailing list
annou...@qt-project.org
https://lists.qt-project.org/listinfo/announce
-- 
Development mailing list
Development@qt-project.org
https://lists.qt-project.org/listinfo/development
_______________________________________________
Announce mailing list
annou...@qt-project.org
https://lists.qt-project.org/listinfo/announce
-- 
Development mailing list
Development@qt-project.org
https://lists.qt-project.org/listinfo/development
  • ... List for announcements regarding Qt releases and development via Announce via Development
    • ... List for announcements regarding Qt releases and development via Announce via Development

Reply via email to