Login Sign Up

CVE-2023-37369

7.5 HIGH
Denial of Service Buffer Overflow

📋 TL;DR

This vulnerability in Qt's XML parsing component (QXmlStreamReader) allows a crafted XML string to trigger an application crash due to a buffer length miscalculation. It affects applications using vulnerable Qt versions for XML processing. The primary impact is denial of service through application crashes.

💻 Affected Systems

Products:
  • Qt Framework
  • Applications using Qt XML parsing
Versions: Qt 5.x before 5.15.15, Qt 6.x before 6.2.9, Qt 6.3.x through 6.5.x before 6.5.2
Operating Systems: Linux, Windows, macOS, All platforms running Qt
Default Config Vulnerable: ⚠️ Yes
Notes: Any application using QXmlStreamReader to parse XML is vulnerable regardless of configuration. The vulnerability is in the core Qt library.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Qt by Qt

View all CVEs affecting Qt →

Qt by Qt

View all CVEs affecting Qt →

Qt by Qt

View all CVEs affecting Qt →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete application crash leading to denial of service, potentially disrupting critical business functions if the application handles mission-critical XML data processing.

🟠

Likely Case

Application instability and crashes when processing malicious or malformed XML input, resulting in service disruption and potential data loss in active sessions.

🟢

If Mitigated

Limited impact with proper input validation and XML sanitization, though the underlying vulnerability remains present in the library.

🌐 Internet-Facing: MEDIUM - Applications accepting XML input from untrusted sources (APIs, file uploads, web forms) are vulnerable to DoS attacks.
🏢 Internal Only: LOW - Internal applications processing trusted XML sources have minimal risk unless exposed to malicious internal actors.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploitation requires sending a crafted XML string to trigger the crash. No authentication needed if the application accepts XML input.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Qt 5.15.15, Qt 6.2.9, Qt 6.5.2 or later

Vendor Advisory: https://bugreports.qt.io/browse/QTBUG-114829

Restart Required: Yes

Instructions:

1. Identify Qt version in use. 2. Update to patched version via package manager (apt, yum, brew) or Qt installer. 3. Recompile applications if using static linking. 4. Restart affected services.

🔧 Temporary Workarounds

XML Input Validation

all

Implement strict XML validation and sanitization before passing to QXmlStreamReader

Rate Limiting XML Processing

all

Limit XML processing requests to reduce DoS impact

🧯 If You Can't Patch

  • Implement network-level XML filtering to block malformed XML patterns
  • Deploy application-level XML schema validation before Qt processing

🔍 How to Verify

Check if Vulnerable:

Check Qt version: qmake --version or examine linked libraries in application

Check Version:

qmake --version | grep -i version

Verify Fix Applied:

Confirm Qt version is 5.15.15+, 6.2.9+, or 6.5.2+ and test XML parsing functionality

📡 Detection & Monitoring

Log Indicators:

  • Application crash logs mentioning QXmlStreamReader
  • Segmentation fault errors during XML processing
  • Abnormal termination of Qt applications

Network Indicators:

  • Spikes in XML payloads to applications
  • Repeated XML submission patterns

SIEM Query:

source="application.log" AND ("segmentation fault" OR "QXmlStreamReader" OR "Qt crash")

📊 Metadata

CVE ID: CVE-2023-37369
CVSS v3 Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: August 20, 2023
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON