Division by zero in Qt - CVE-2023-32573

Vulnerability identifier: #VU76665

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-32573

CWE-ID: CWE-369

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a divide by zero error in src/svg/qsvghandler.cpp. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Qt
Gentoo Linux
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
Oracle Linux
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Oracle Solaris
SUSE Linux Enterprise Workstation Extension 12
Desktop Applications Module
Basesystem Module
openSUSE Leap
openEuler
Fedora
Telemetry Dashboard
Liquidware
Citrix Workspace App
Webex App VDI
Pair
Dell Peripheral Manager
IBM Cloud Pak for Watson AIOps
Traffix SDC
VMware Horizon Client
Red Hat OpenShift Container Platform
OpenShift Logging
Netcool Operations Insight
Cisco Jabber
BIG-IP
Cisco Webex Meetings
qgnomeplatform (Red Hat package)
libadwaita-qt5
adwaita-qt5
adwaita-qt (Red Hat package)
libqt4-devel
libqt4-x11
libqt4-sql-debuginfo
libqt4-sql-mysql-debuginfo
libqt4-qt3support-debuginfo
libqt4
libqt4-devel-doc-data
libqt4-devel-doc-debugsource
libqt4-sql-mysql
qt4-x11-tools-debuginfo
libqt4-x11-debuginfo
libqt4-sql-sqlite-debuginfo
libqt4-sql
libqt4-qt3support
libqt4-sql-sqlite
libqt4-debugsource
libqt4-debuginfo
libqt4-linguist-debuginfo
libqt4-private-headers-devel
libqt4-devel-doc-debuginfo
libqt4-linguist
libqt4-devel-doc
libqt4-devel-debuginfo
libqt4-sql-postgresql-debuginfo
libqt4-sql-sqlite-debuginfo-32bit
libqt4-sql-mysql-debuginfo-32bit
libqt4-sql-unixODBC-32bit
libqt4-sql-debuginfo-32bit
libqt4-sql-postgresql-32bit
libqt4-sql-mysql-32bit
libqt4-debuginfo-32bit
libqt4-sql-sqlite-32bit
libqt4-sql-unixODBC-debuginfo-32bit
libqt4-sql-unixODBC-debuginfo
libqt4-sql-unixODBC
libqt4-sql-postgresql-debuginfo-32bit
libqt4-sql-postgresql
libqt4-sql-plugins-debugsource
libqt4-32bit
libqt4-qt3support-32bit
libqt4-sql-32bit
libqt4-x11-debuginfo-32bit
qt4-x11-tools
libqt4-qt3support-debuginfo-32bit
libqt4-x11-32bit
qt-debuginfo
qt-devel
qt-debugsource
qt
libqt5-qtsvg-private-headers-devel
libQt5Svg5
libQt5Svg5-debuginfo
libqt5-qtsvg-devel
libqt5-qtsvg-debugsource
libQt5Svg5-64bit
libqt5-qtsvg-examples
libqt5-qtsvg-examples-debuginfo
libQt5Svg5-32bit-debuginfo
libqt5-qtsvg-devel-32bit
libQt5Svg5-32bit
libQt5Svg5-64bit-debuginfo
libqt5-qtsvg-devel-64bit
qt5-qtsvg-examples
qt5-qtsvg
qt5-qtsvg-devel
qt5-qtsvg (Red Hat package)
dev-qt/qtsvg
qt5-qt3d (Red Hat package)
qt5-qtserialport (Red Hat package)
qt5-qtscript (Red Hat package)
qt5-qtquickcontrols2 (Red Hat package)
qt5-qtquickcontrols (Red Hat package)
qt5-qtmultimedia (Red Hat package)
qt5-qtlocation (Red Hat package)
qt5-qtimageformats (Red Hat package)
qt5-qtgraphicaleffects (Red Hat package)
qt5-qtdoc (Red Hat package)
qt5-qtsensors (Red Hat package)
qt5-qtserialbus (Red Hat package)
qt5-doc (Red Hat package)
qt5 (Red Hat package)
python-qt5 (Red Hat package)
qt5-qttranslations (Red Hat package)
qt5-qtwayland (Red Hat package)
qt5-qtwebchannel (Red Hat package)
qt5-qtx11extras (Red Hat package)
qt5-qtxmlpatterns (Red Hat package)
qt5-qtwebsockets (Red Hat package)
qt5-qtconnectivity (Red Hat package)
qt5-qtdeclarative (Red Hat package)
qt5-qttools (Red Hat package)
qt5-qtbase (Red Hat package)
python-pyqt5-sip (Red Hat package)

Install updates from vendor's website.

Qt - addressed in versions 5.15.14, 6.2.9, 6.5.1
Telemetry Dashboard - update to 1.1.0.6 on Thin OS 2405
OpenShift Logging - update to 5.8.1
Liquidware - update to 6.7.0.2.2 on Thin OS 2405
Cisco Jabber - update to 14.3.0.308378.11 on Thin OS 2405
Citrix Workspace App - update to 24.2.0.65.17 on Thin OS 2405
Webex App VDI - update to 44.2.0.28744.1 on Thin OS 2405
Cisco Webex Meetings - update to 44.2.0.76.2 on Thin OS 2405
VMware Horizon Client - update to 2312.1.8.12.1.5 on Thin OS 2405
qgnomeplatform (Red Hat package) - update to 0.9.0-1.el9
Pair - update to 1.2.3
libadwaita-qt5 - update to 1.4.2-1
adwaita-qt5 - update to 1.4.2-1
adwaita-qt (Red Hat package) - update to 1.4.2-1.el9
Netcool Operations Insight - update to 1.6.12
Dell Peripheral Manager - update to 1.7.3
IBM Cloud Pak for Watson AIOps - update to 4.4.0
libqt4-devel - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-x11 - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-mysql-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-qt3support-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4 - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-devel-doc-data - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-devel-doc-debugsource - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-mysql - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
qt4-x11-tools-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-x11-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-sqlite-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-qt3support - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-sqlite - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-debugsource - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-linguist-debuginfo - update to 4.8.7-8.19.1
libqt4-private-headers-devel - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-devel-doc-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-linguist - update to 4.8.7-8.19.1
libqt4-devel-doc - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-devel-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-postgresql-debuginfo - update to 4.8.7-8.19.1
libqt4-sql-sqlite-debuginfo-32bit - update to 4.8.7-8.19.1
libqt4-sql-mysql-debuginfo-32bit - update to 4.8.7-8.19.1
libqt4-sql-unixODBC-32bit - update to 4.8.7-8.19.1
libqt4-sql-debuginfo-32bit - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-postgresql-32bit - update to 4.8.7-8.19.1
libqt4-sql-mysql-32bit - update to 4.8.7-8.19.1
libqt4-debuginfo-32bit - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-sqlite-32bit - update to 4.8.7-8.19.1
libqt4-sql-unixODBC-debuginfo-32bit - update to 4.8.7-8.19.1
libqt4-sql-unixODBC-debuginfo - update to 4.8.7-8.19.1
libqt4-sql-unixODBC - update to 4.8.7-8.19.1
libqt4-sql-postgresql-debuginfo-32bit - update to 4.8.7-8.19.1
libqt4-sql-postgresql - update to 4.8.7-8.19.1
libqt4-sql-plugins-debugsource - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-32bit - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-qt3support-32bit - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-32bit - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-x11-debuginfo-32bit - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
qt4-x11-tools - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-qt3support-debuginfo-32bit - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-x11-32bit - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
qt-debuginfo - addressed in versions 4.8.7-51, 4.8.7-53
qt-devel - addressed in versions 4.8.7-51, 4.8.7-53
qt-debugsource - addressed in versions 4.8.7-51, 4.8.7-53
qt - addressed in versions 4.8.7-51, 4.8.7-53
qt - addressed in versions 4.8.7-72.fc38, 4.8.7-73.fc38
Red Hat OpenShift Container Platform - addressed in versions 4.16.15, 4.17.0
libqt5-qtsvg-private-headers-devel - addressed in versions 5.6.2-3.11.1, 5.12.7-150200.3.8.1, 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libQt5Svg5 - addressed in versions 5.6.2-3.11.1, 5.12.7-150200.3.8.1, 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libQt5Svg5-debuginfo - addressed in versions 5.6.2-3.11.1, 5.12.7-150200.3.8.1, 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libqt5-qtsvg-devel - addressed in versions 5.6.2-3.11.1, 5.12.7-150200.3.8.1, 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libqt5-qtsvg-debugsource - addressed in versions 5.6.2-3.11.1, 5.12.7-150200.3.8.1, 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libQt5Svg5-64bit - addressed in versions 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libqt5-qtsvg-examples - addressed in versions 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libqt5-qtsvg-examples-debuginfo - addressed in versions 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libQt5Svg5-32bit-debuginfo - addressed in versions 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libqt5-qtsvg-devel-32bit - addressed in versions 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libQt5Svg5-32bit - addressed in versions 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libQt5Svg5-64bit-debuginfo - addressed in versions 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libqt5-qtsvg-devel-64bit - addressed in versions 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
qt5-qtsvg-examples - update to 5.15.3-2
qt5-qtsvg - update to 5.15.3-2
qt5-qtsvg-devel - update to 5.15.3-2
qt5-qtsvg (Red Hat package) - addressed in versions 5.15.3-2.el8, 5.15.9-2.el9
dev-qt/qtsvg - update to 5.15.9-r1
qt5-qt3d (Red Hat package) - update to 5.15.9-1.el9
qt5-qtserialport (Red Hat package) - update to 5.15.9-1.el9
qt5-qtscript (Red Hat package) - update to 5.15.9-1.el9
qt5-qtquickcontrols2 (Red Hat package) - update to 5.15.9-1.el9
qt5-qtquickcontrols (Red Hat package) - update to 5.15.9-1.el9
qt5-qtmultimedia (Red Hat package) - update to 5.15.9-1.el9
qt5-qtlocation (Red Hat package) - update to 5.15.9-1.el9
qt5-qtimageformats (Red Hat package) - update to 5.15.9-1.el9
qt5-qtgraphicaleffects (Red Hat package) - update to 5.15.9-1.el9
qt5-qtdoc (Red Hat package) - update to 5.15.9-1.el9
qt5-qtsensors (Red Hat package) - update to 5.15.9-1.el9
qt5-qtserialbus (Red Hat package) - update to 5.15.9-1.el9
qt5-doc (Red Hat package) - update to 5.15.9-1.el9
qt5 (Red Hat package) - update to 5.15.9-1.el9
python-qt5 (Red Hat package) - update to 5.15.9-1.el9
qt5-qttranslations (Red Hat package) - update to 5.15.9-1.el9
qt5-qtwayland (Red Hat package) - update to 5.15.9-1.el9
qt5-qtwebchannel (Red Hat package) - update to 5.15.9-1.el9
qt5-qtx11extras (Red Hat package) - update to 5.15.9-1.el9
qt5-qtxmlpatterns (Red Hat package) - update to 5.15.9-2.el9
qt5-qtwebsockets (Red Hat package) - update to 5.15.9-2.el9
qt5-qtconnectivity (Red Hat package) - update to 5.15.9-2.el9
qt5-qtdeclarative (Red Hat package) - update to 5.15.9-3.el9
qt5-qttools (Red Hat package) - update to 5.15.9-3.el9
qt5-qtbase (Red Hat package) - update to 5.15.9-7.el9
python-pyqt5-sip (Red Hat package) - update to 12.11.1-1.el9

• https://codereview.qt-project.org/c/qt/qtsvg/+/474093

• Multiple vulnerabilities in Qt
• SUSE update for libqt5-qtsvg
• SUSE update for libqt5-qtsvg
• SUSE update for libqt5-qtsvg
• Fedora 38 update for qt
• Fedora 38 update for qt
• Multiple vulnerabilities in Oracle Solaris third-party software
• Red Hat Enterprise Linux 9 update for the qt5 stack
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 8 update for qt5-qtsvg
• SUSE update for libqt4
• Multiple vulnerabilities in Logging Subsystem 5.8 for Red Hat OpenShift
• SUSE update for libqt5-qtsvg
• openEuler 20.03 LTS SP1 update for qt
• openEuler 20.03 LTS SP3 update for qt
• openEuler 22.03 LTS update for qt
• openEuler 22.03 LTS SP1 update for qt
• openEuler 22.03 LTS SP2 update for qt
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Dell Peripheral Manager
• Multiple vulnerabilities in Dell ThinOS
• Gentoo update for qtsvg
• Multiple vulnerabilities in Dell Pair
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Denial of service in F5 BIG-IP Qt library
• Denial of service in F5 Traffix SDC Qt library
• Anolis OS update for adwaita-qt
• Anolis OS update for qt5-qtsvg
• SUSE update for libqt4