Search for vulnerabilities
Vulnerability details: VCID-jrjh-paqc-aaab
Vulnerability ID VCID-jrjh-paqc-aaab
Aliases CVE-2023-37369
Summary In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-37369.json
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00136 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00167 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00167 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00167 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00167 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00291 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00291 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.00291 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.01647 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.01647 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.01647 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.01647 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.01647 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.01647 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.01647 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.01647 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.01647 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.01647 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.01647 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.01647 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.01647 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.01647 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
epss 0.0244 https://api.first.org/data/v1/epss?cve=CVE-2023-37369
cvssv3.1 5.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-37369
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2023-37369
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-37369.json
https://api.first.org/data/v1/epss?cve=CVE-2023-37369
https://bugreports.qt.io/browse/QTBUG-114829
https://codereview.qt-project.org/c/qt/qtbase/+/455027
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37369
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://lists.debian.org/debian-lts-announce/2023/08/msg00028.html
https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3JR3N3IF5MUSETGYE46OZFOGGPY3VZT/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZK7EDD4ILPPSQAYO54FANUC4NFYLTHU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O3JR3N3IF5MUSETGYE46OZFOGGPY3VZT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SZK7EDD4ILPPSQAYO54FANUC4NFYLTHU/
1059302 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1059302
2232173 https://bugzilla.redhat.com/show_bug.cgi?id=2232173
cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
CVE-2023-37369 https://nvd.nist.gov/vuln/detail/CVE-2023-37369
GLSA-202501-08 https://security.gentoo.org/glsa/202501-08
RHSA-2023:6369 https://access.redhat.com/errata/RHSA-2023:6369
RHSA-2023:6967 https://access.redhat.com/errata/RHSA-2023:6967
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-37369.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-37369
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-37369
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.48824
EPSS Score 0.00129
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.