Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 906465 (CVE-2023-32573)

Summary: <dev-qt/qtsvg-5.15.9-r1: Uninitialized variable usage in m_unitsPerEm
Product: Gentoo Security Reporter: Sam James <sam>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal CC: ajak, qt
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://invent.kde.org/qt/qt/qtsvg/-/commit/837b5163e17edbd3a9f098e9a1ab73febab419b4
Whiteboard: B4 [glsa+]
Package list:
Runtime testing required: ---
Bug Depends on: 905842    
Bug Blocks:    

Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-05-15 19:21:30 UTC
"In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled."
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-05-15 19:21:56 UTC
Stable bug is done so only really need qt@ to confirm this is the same bug fixed in 5.15.9-r1.
Comment 2 Andreas Sturmlechner gentoo-dev 2023-05-18 15:29:11 UTC
That's what that commit appeared to do.
Comment 4 Larry the Git Cow gentoo-dev 2024-05-08 09:13:56 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=2456b87477e6ccf454b884c2405316b8102a652b

commit 2456b87477e6ccf454b884c2405316b8102a652b
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2024-05-08 09:13:29 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2024-05-08 09:13:49 +0000

    [ GLSA 202405-26 ] qtsvg: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/830381
    Bug: https://bugs.gentoo.org/906465
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 glsa-202405-26.xml | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)