SUSE-SU-2023:2967-1: Security update for libqt5-qtsvg
This update for libqt5-qtsvg fixes the following issues: CVE-2021-45930: Fixed an out-of-bounds write that may have let to a denial-of-service (bsc#1196654). CVE-2023-32573: Fixed missing initialization of QtSvg QSvgFont munitsPerEm variable (bsc#1211298).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/libqt5-qtsvg-debugsourceto a version that resolves this vulnerability.Fixed in 5.6.2-3.11.1 - Upgrade
Upgrade
suse/libqt5-qtsvg-develto a version that resolves this vulnerability.Fixed in 5.6.2-3.11.1 - Upgrade
Upgrade
suse/libqt5-qtsvg-private-headers-develto a version that resolves this vulnerability.Fixed in 5.6.2-3.11.1 - Upgrade
Upgrade
suse/libQt5Svg5to a version that resolves this vulnerability.Fixed in 5.6.2-3.11.1 - Upgrade
Upgrade
suse/libQt5Svg5-debuginfoto a version that resolves this vulnerability.Fixed in 5.6.2-3.11.1 - Upgrade
Upgrade
libqt5-qtsvgto a version that resolves this vulnerability.Patch SUSE-SLE-SDK-12-SP5-2023-2967=1 - Upgrade
Upgrade
libqt5-qtsvgto a version that resolves this vulnerability.Patch SUSE-SLE-SERVER-12-SP5-2023-2967=1
Event History
Frequently Asked Questions
Which installed packages are covered by this update?
The update covers libqt5svg5 and related development, private-header, debugsource, and debuginfo packages. It is listed for SUSE Linux Enterprise Software Development Kit 12 SP5 on aarch64, ppc64le, s390x, and x86_64, and for SUSE Linux Enterprise High Performance Computing 12 SP5 on aarch64 and x86_64.
What impact is addressed by the known memory-safety issue?
CVE-2021-45930 fixes an out-of-bounds write in the Qt SVG component that may have allowed denial of service. The advisory does not state exploitation prerequisites, affected configuration details, or mitigations other than applying the update.
Are both listed CVEs the same type of flaw?
No. CVE-2021-45930 is an out-of-bounds write, while CVE-2023-32573 concerns missing initialization of the QtSvg QSvgFont m_unitsPerEm variable.