
CVE catalog
CVE-2023-37369
qt6-base affected and fixed versions
A flaw was found in the qtbase package. When given specifically crafted data, the QXmlStreamReader can end up causing a buffer overflow and, subsequently, a crash. qtbase: buffer overflow in QXmlStreamReader The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.58% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [
{
"name": "qt6-base",
"status": "fixed",
"release": "sid",
"version": "6.11.2+dfsg-7"
},
{
"name": "qt6-base",
"status": "fixed",
"release": "forky",
"version": "6.11.2+dfsg-5"
},
{
"name": "qt6-base",
"status": "fixed",
"release": "trixie",
"version": "6.8.2+dfsg-9+deb13u2"
},
{
"name": "qt6-base",
"status": "vulnerable",
"release": "bookworm",
"version": "6.4.2+dfsg-10"
},
{
"name": "qtbase-opensource-src",
"status": "fixed",
"release": "sid",
"version": "5.15.19+dfsg-6"
},
{
"name": "qtbase-opensource-src",
"status": "fixed",
"release": "forky",
"version": "5.15.19+dfsg-5"
},
{
"name": "qtbase-opensource-src",
"status": "fixed",
"release": "trixie",
"version": "5.15.15+dfsg-6+deb13u1"
},
{
"name": "qtbase-opensource-src",
"status": "fixed",
"release": "bookworm",
"version": "5.15.8+dfsg-11+deb12u3"
},
{
"name": "qtbase-opensource-src-gles",
"status": "fixed",
"release": "sid",
"version": "5.15.19+dfsg-2"
},
{
"name": "qtbase-opensource-src-gles",
"status": "fixed",
"release": "forky",
"version": "5.15.19+dfsg-2"
},
{
"name": "qtbase-opensource-src-gles",
"status": "fixed",
"release": "trixie",
"version": "5.15.15+dfsg-2"
},
{
"name": "qtbase-opensource-src-gles",
"status": "vulnerable",
"release": "bookworm",
"version": "5.15.8+dfsg-3"
}
],
"fixed_versions": [
{
"bug": 1059302,
"name": "qt6-base",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": "6.4.2+dfsg-20"
},
{
"bug": 1059302,
"name": "qt6-base",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "not yet assigned",
"fixed_version": "6.4.2+dfsg-20"
},
{
"bug": 1059302,
"name": "qt6-base",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": "6.4.2+dfsg-20"
},
{
"bug": 1059302,
"name": "qt6-base",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": ""
},
{
"bug": null,
"name": "qtbase-opensource-src",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": "5.15.10+dfsg-3"
},
{
"bug": null,
"name": "qtbase-opensource-src",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "not yet assigned",
"fixed_version": "5.15.10+dfsg-3"
},
{
"bug": null,
"name": "qtbase-opensource-src",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": "5.15.10+dfsg-3"
},
{
"bug": null,
"name": "qtbase-opensource-src",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": "5.15.8+dfsg-11+deb12u1"
},
{
"bug": null,
"name": "qtbase-opensource-src-gles",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": "5.15.10+dfsg-2"
},
{
"bug": null,
"name": "qtbase-opensource-src-gles",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "not yet assigned",
"fixed_version": "5.15.10+dfsg-2"
},
{
"bug": null,
"name": "qtbase-opensource-src-gles",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": "5.15.10+dfsg-2"
},
{
"bug": null,
"name": "qtbase-opensource-src-gles",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": ""
}
],
"distribution_packages": [
{
"name": "libqt5-qtbase",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.15.11+kde138-3.1"
}
]
}
],
"release": "tumbleweed",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "5.15.11+kde138-3.1",
"provider_record_id": "OPENSUSE-SU-2024:13470-1"
},
{
"name": "libqt5-qtbase",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.12.7-150200.4.29.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp2-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "5.12.7-150200.4.29.1",
"provider_record_id": "SUSE-SU-2024:2946-1"
},
{
"name": "libqt5-qtbase",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.12.7-150200.4.29.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp3-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "5.12.7-150200.4.29.1",
"provider_record_id": "SUSE-SU-2024:2946-1"
},
{
"name": "libqt5-qtbase",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.12.7-150200.4.29.1"
}
]
}
],
"release": "linux enterprise server 15 sp2-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "5.12.7-150200.4.29.1",
"provider_record_id": "SUSE-SU-2024:2946-1"
},
{
"name": "libqt5-qtbase",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.12.7-150200.4.29.1"
}
]
}
],
"release": "linux enterprise server 15 sp3-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "5.12.7-150200.4.29.1",
"provider_record_id": "SUSE-SU-2024:2946-1"
},
{
"name": "libqt5-qtbase",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.12.7-150200.4.29.1"
}
]
}
],
"release": "linux enterprise server for sap applications 15 sp2",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "5.12.7-150200.4.29.1",
"provider_record_id": "SUSE-SU-2024:2946-1"
},
{
"name": "libqt5-qtbase",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.12.7-150200.4.29.1"
}
]
}
],
"release": "linux enterprise server for sap applications 15 sp3",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "5.12.7-150200.4.29.1",
"provider_record_id": "SUSE-SU-2024:2946-1"
},
{
"name": "libqt5-qtbase",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.12.7-150200.4.29.1"
}
]
}
],
"release": "enterprise storage 7.1",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "5.12.7-150200.4.29.1",
"provider_record_id": "SUSE-SU-2024:2946-1"
},
{
"name": "libqt5-qtbase",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.15.8+kde185-150500.4.13.1"
}
]
}
],
"release": "linux enterprise module for basesystem 15 sp5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "5.15.8+kde185-150500.4.13.1",
"provider_record_id": "SUSE-SU-2023:4951-1"
},
{
"name": "libqt5-qtbase",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.15.8+kde185-150500.4.13.1"
}
]
}
],
"release": "linux enterprise module for desktop applications 15 sp5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "5.15.8+kde185-150500.4.13.1",
"provider_record_id": "SUSE-SU-2023:4951-1"
},
{
"name": "libqt5-qtbase",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.15.8+kde185-150500.4.13.1"
}
]
}
],
"release": "leap 15.5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "5.15.8+kde185-150500.4.13.1",
"provider_record_id": "SUSE-SU-2023:4951-1"
},
{
"name": "libqt5-qtbase",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.15.2+kde294-150400.6.10.1"
}
]
}
],
"release": "linux enterprise module for basesystem 15 sp4",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "5.15.2+kde294-150400.6.10.1",
"provider_record_id": "SUSE-SU-2023:4950-1"
},
{
"name": "libqt5-qtbase",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.15.2+kde294-150400.6.10.1"
}
]
}
],
"release": "linux enterprise module for desktop applications 15 sp4",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "5.15.2+kde294-150400.6.10.1",
"provider_record_id": "SUSE-SU-2023:4950-1"
},
{
"name": "libqt5-qtbase",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.15.2+kde294-150400.6.10.1"
}
]
}
],
"release": "leap 15.4",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "5.15.2+kde294-150400.6.10.1",
"provider_record_id": "SUSE-SU-2023:4950-1"
}
]
}Publisher notes
[bookworm] qt6-base: Minor issue [bookworm] qtbase-opensource-src-gles: Minor issue
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [libqt5concurrent5]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt5core5a]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt5dbus5]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt5gui5]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt5gui5-gles]Unknown
Source package: [qtbase-opensource-src-gles]
Details (2)
5.15.8+dfsg-3· amd64 · bookwormAffected
dsa · qtbase-opensource-src-gles · debian · bookworm; dsa · qtbase-opensource-src-gles · debian · 12
5.15.8+dfsg-3· arm64 · bookwormAffected
dsa · qtbase-opensource-src-gles · debian · bookworm; dsa · qtbase-opensource-src-gles · debian · 12
- [libqt5network5]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt5opengl5]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt5opengl5-dev]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt5printsupport5]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt5sql5]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt5sql5-ibase]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt5sql5-mysql]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt5sql5-odbc]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt5sql5-psql]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt5sql5-sqlite]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt5sql5-tds]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt5test5]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt5widgets5]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt5xml5]Unknown
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
5.15.8+dfsg-11+deb12u3· arm64 · bookwormFixed · Fixed:
5.15.8+dfsg-11+deb12u1dsa · qtbase-opensource-src · debian · bookworm; dsa · qtbase-opensource-src · debian · 12
- [libqt6concurrent6]Unknown
Source package: [qt6-base]
Details (2)
6.4.2+dfsg-10· amd64 · bookwormAffected
dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
6.4.2+dfsg-10· arm64 · bookwormAffected
dsa · qt6-base · debian · bookworm; dsa · qt6-base · debian · 12
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2023_6967.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2023-37369]
- [https://osv.dev/vulnerability/SUSE-SU-2023:4950-1]
- [https://osv.dev/vulnerability/SUSE-SU-2023:4951-1]
- [https://osv.dev/vulnerability/SUSE-SU-2024:2946-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:13470-1]
- [https://security-tracker.debian.org/tracker/CVE-2023-37369]
- [https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-37369.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2066.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]