Qt vulnerabilities

An integer overflow vulnerability exists in the Qt XML parsing functionality (Qt5Compat / QXmlSimpleReader). It may cause incorrect parser behavior when processing crafted XML data.

An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer, which can cause the application to crash and may affect data integrity.

Incomplete cleanup in Qt Network's Schannel support on Windows can lead to a Denial of Service over time. Affects Qt from 5.15.0 through 6.8.3 and from 6.9.0 before 6.9.2.

In the HTTP2 implementation in Qt before 5.15.17, 6.2.11, 6.5.4, and 6.6.2, there is an incorrect HPack integer overflow check in hpacktable.cpp.

A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module. It may lead to application crashes when processing CBOR data.

An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Applications that convert text to the TSCII encoding through QTextCodec may read memory outside the input buffer, which can cause the application to crash or misinterpret the data.

Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.

A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of an out-of-bounds read.

Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document.

QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.

An out-of-bounds read vulnerability in QTextCodec::codecForName() in Qt. When called with a non-NUL-terminated QByteArray, the codec-name matching routine reads past the buffer. This usually results in incorrect codec selection; worst case, it causes a crash (DoS). Affects Qt5Compat module from Qt 6.0.0 and Qt Core in Qt 4.x and 5.x.

In Qt Quick, the Text component lacks validation of width and height in the <img> tag, potentially causing excessive resource allocation and application unresponsiveness. Affects Qt from 5.0.0 through 6.10.0.

QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero). The vulnerability is fixed in versions 5.15.19, 6.5.9, and 6.8.2.

A vulnerability in Qt's QColorTransferGenericFunction causes a denial of service when passing values outside the expected range, e.g., when processing a specially crafted ICC profile via QColorSpace::fromICCProfile. Affects Qt from 6.6.0 through 6.8.3 and from 6.9.0 through 6.9.1; fixed in 6.8.4 and 6.9.2.

A Use-After-Free vulnerability in Qt's QHttp2ProtocolHandler in the QtNetwork module affects only HTTP/2 handling. It arises from a race condition between uploading POST request body and simultaneous handling of HTTP errors. Affects only Qt 6.9.0; fixed in Qt 6.9.1.

A vulnerability in Qt causes a crash when loading a specially crafted ICNS image file via QImage. Affects Qt versions 6.3.0 through 6.5.9, 6.6.0 through 6.8.4, and 6.9.0. Fixed in 6.5.10, 6.8.5, and 6.9.1.

An issue was found in the private API function qDecodeDataUrl() in QtCore, used in QTextDocument and QNetworkReply. Calling it with malformed data, e.g., a URL with a "charset" parameter lacking a value, triggers an assertion and aborts the program (denial of service).

A symlink attack vulnerability was found in the Qt corelib module on Windows via QFileSystemEngine. The use of GetTempPath API allows manipulation of temporary file paths, potentially leading to unauthorized access and privilege escalation.

A heap-based buffer overflow vulnerability was found in QTextMarkdownImporter in Qt. It occurs when processing a malformed Markdown file. Affects Qt versions 6.8.0 to 6.8.4; versions up to 6.6.0 are unaffected, and the fix is in 6.8.4 and later.

In versions of Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length.

An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 related to infinite loops in recursive entity expansion.

An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2 related to TLS certificate validation. The validation does not always consider whether the root of a chain is a configured CA certificate.

An issue was discovered in Qt versions 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1 related to QDnsLookup, allowing for a buffer over-read via a crafted reply from a DNS server.

Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath, called from QRasterPaintEngine::fill and QPaintEngineEx::stroke.

Vulnerability in Qt version 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.