CVE-2023-43114

2023-09-1807:15:38

Debian Security Bug Tracker

security-tracker.debian.org

font engine

windows

gdi

application crash

missing length checks

vulnerability

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

12.8%

JSON

An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupted font is loaded via QFontDatabase::addApplicationFont{FromData], then it can cause the application to crash because of missing length checks.

OSVersionArchitecturePackageVersionFilename
Debian10allqt4-x11< 4:4.8.7+dfsg-18+deb10u1qt4-x11_4:4.8.7+dfsg-18+deb10u1_all.deb
Debian12allqt6-base< 6.4.2+dfsg-10qt6-base_6.4.2+dfsg-10_all.deb
Debian999allqt6-base< 6.6.2+dfsg-8qt6-base_6.6.2+dfsg-8_all.deb
Debian13allqt6-base< 6.6.2+dfsg-8qt6-base_6.6.2+dfsg-8_all.deb
Debian12allqtbase-opensource-src< 5.15.8+dfsg-11qtbase-opensource-src_5.15.8+dfsg-11_all.deb
Debian11allqtbase-opensource-src< 5.15.2+dfsg-9qtbase-opensource-src_5.15.2+dfsg-9_all.deb
Debian10allqtbase-opensource-src< 5.11.3+dfsg1-1+deb10u5qtbase-opensource-src_5.11.3+dfsg1-1+deb10u5_all.deb
Debian999allqtbase-opensource-src< 5.15.13+dfsg-2qtbase-opensource-src_5.15.13+dfsg-2_all.deb
Debian13allqtbase-opensource-src< 5.15.13+dfsg-2qtbase-opensource-src_5.15.13+dfsg-2_all.deb
Debian12allqtbase-opensource-src-gles< 5.15.8+dfsg-3qtbase-opensource-src-gles_5.15.8+dfsg-3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	all	qt4-x11	< 4:4.8.7+dfsg-18+deb10u1	qt4-x11_4:4.8.7+dfsg-18+deb10u1_all.deb
Debian	12	all	qt6-base	< 6.4.2+dfsg-10	qt6-base_6.4.2+dfsg-10_all.deb
Debian	999	all	qt6-base	< 6.6.2+dfsg-8	qt6-base_6.6.2+dfsg-8_all.deb
Debian	13	all	qt6-base	< 6.6.2+dfsg-8	qt6-base_6.6.2+dfsg-8_all.deb
Debian	12	all	qtbase-opensource-src	< 5.15.8+dfsg-11	qtbase-opensource-src_5.15.8+dfsg-11_all.deb
Debian	11	all	qtbase-opensource-src	< 5.15.2+dfsg-9	qtbase-opensource-src_5.15.2+dfsg-9_all.deb
Debian	10	all	qtbase-opensource-src	< 5.11.3+dfsg1-1+deb10u5	qtbase-opensource-src_5.11.3+dfsg1-1+deb10u5_all.deb
Debian	999	all	qtbase-opensource-src	< 5.15.13+dfsg-2	qtbase-opensource-src_5.15.13+dfsg-2_all.deb
Debian	13	all	qtbase-opensource-src	< 5.15.13+dfsg-2	qtbase-opensource-src_5.15.13+dfsg-2_all.deb
Debian	12	all	qtbase-opensource-src-gles	< 5.15.8+dfsg-3	qtbase-opensource-src-gles_5.15.8+dfsg-3_all.deb