CVE-2023-38197

A vulnerability was found in Qtbase, where it is vulnerable to a denial of service caused by an infinite loop flaw in the QXmlStreamReader() function. This flaw occurs because the QXmlStreamReader function accepts multiple DOCTYPE elements containing DTD fragments in the XML prolog and the XML body. Well-formed but invalid XML files - with multiple DTD fragments in prolog and body, combined with recursive entity expansions, causes infinite loops in QXmlStreamReader. By persuading a victim to open specially crafted XML content, an attacker can cause a denial of service condition.

This update for libqt5-qtbase fixes the following issues. Fixed Qt SQL ODBC driver plugin DOS. Fixed Qt Network incorrectly parses the strict-transport-security header. Fixed buffer overflow when rendering an SVG file with an image inside it. Fixed buffer overflow in QDnsLookup. Fixed certificate validation does not always consider whether the root of a chain is a configured CA certificate. Fixed infinite loops in QXmlStreamReader.