SUSE Package Hub - SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-3380

Update Info

SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-3380

Security update for qt6-base

Type: security

Severity: important

Issued: 2023-08-22

Description:

This update for qt6-base fixes the following issues:

- CVE-2023-34410: Fixed certificate validation flaw (bsc#1211994).
- CVE-2023-33285: Fixed buffer overflow in QDnsLookup (bsc#1211642).
- CVE-2023-32762: Fixed strict-transport-security (HSTS) header parsing error (QTBUG-113392) (bsc#1211797).
- CVE-2023-38197: Fixed infinite loops in QXmlStreamReader (QTBUG-92113, QTBUG-95188) (bsc#1213326).
- CVE-2023-32763: Fixed buffer overflow in QTextLayout (QTBUG-113337, QTBUG-106947, QTBUG-89557, QTBUG-104986) (bsc#1211798).

References

CVE: CVE-2023-38197
CVE: CVE-2023-34410
CVE: CVE-2023-33285
CVE: CVE-2023-32763
CVE: CVE-2023-32762
Bugzilla: 1213326 VUL-0: CVE-2023-38197: qt6-base,qt3,libqt4,libqt5-qtbase: infinite loops in QXmlStreamReader
Bugzilla: 1211994 VUL-0: CVE-2023-34410: libqt5-qtbase,qt6-base: certificate validation does not always consider whether the root of a chain is a configured CA certificate
Bugzilla: 1211798 VUL-0: CVE-2023-32763: qt3,libqt5-qtbase,qt6-base,libqt4: When a SVG file with an image inside it is rendered, a QTextLayout buffer overflow can be triggered
Bugzilla: 1211797 VUL-0: CVE-2023-32762: qt6-base,qt3,libqt4,libqt5-qtbase: Qt Network incorrectly parses the strict-transport-security (HSTS) header
Bugzilla: 1211642 VUL-0: CVE-2023-33285: libqt5-qtbase,qt6-base: Buffer overflow in QDnsLookup

Packages

qt6-base-6.2.2-150400.4.6.1