Qt up to 5.15.14/6.2.9/6.5.2 Entity Expansion infinite loop

Summaryinfo

A vulnerability was found in Qt up to 5.15.14/6.2.9/6.5.2 and classified as problematic. This affects an unknown function of the component Entity Expansion Handler. The manipulation results in infinite loop. This vulnerability is known as CVE-2023-38197. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Qt up to 5.15.14/6.2.9/6.5.2. Affected is an unknown code of the component Entity Expansion Handler. The manipulation with an unknown input leads to a infinite loop vulnerability. CWE is classifying the issue as CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. This is going to have an impact on availability. CVE summarizes:

An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion.

The weakness was published 07/13/2023. This vulnerability is traded as CVE-2023-38197. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 212010 (F5 Networks BIG-IP : Qt vulnerabilities (K000148809)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.15.15, 6.2.10 or 6.5.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (212010) and EUVD (EUVD-2023-42019). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Qt

Version

• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3
• 6.2.4
• 6.2.5
• 6.2.6
• 6.2.7
• 6.2.8
• 6.2.9
• 6.5.0
• 6.5.1
• 6.5.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion