Qt up to 5.15.15/6.2.9/6.5.2 on Windows GDI Font Engine addApplicationFont{FromData denial of service

Summaryinfo

A vulnerability classified as problematic was found in Qt up to 5.15.15/6.2.9/6.5.2 on Windows. This affects the function QFontDatabase::addApplicationFont{FromData of the component GDI Font Engine. Executing a manipulation can lead to denial of service. This vulnerability is registered as CVE-2023-43114. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in Qt up to 5.15.15/6.2.9/6.5.2 on Windows and classified as problematic. This vulnerability affects the function QFontDatabase::addApplicationFont{FromData of the component GDI Font Engine. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. CVE summarizes:

An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupted font is loaded via QFontDatabase::addApplicationFont{FromData], then it can cause the application to crash because of missing length checks.

The weakness was published 09/18/2023. The advisory is available at codereview.qt-project.org. This vulnerability was named CVE-2023-43114 since 09/18/2023. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 250091 (Linux Distros Unpatched Vulnerability : CVE-2023-43114), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.15.16, 6.2.10 or 6.5.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (250091) and EUVD (EUVD-2023-47535). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Qt

Version

• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 5.15.15
• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3
• 6.2.4
• 6.2.5
• 6.2.6
• 6.2.7
• 6.2.8
• 6.2.9
• 6.5.0
• 6.5.1
• 6.5.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion