Description
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qt6-base | 6.6.2+dfsg-8 | — |
| Debian 14 | qtbase-opensource-src +1 | 5.15.10+dfsg-3 | — |
| Debian 13 | qt6-base | 6.6.2+dfsg-8 | — |
| Debian 13 | qtbase-opensource-src +1 | 5.15.10+dfsg-3 | — |
| Debian 12 | qt6-base +1 | No fix yet | — |
| Debian 12 | qtbase-opensource-src | 5.15.8+dfsg-11+deb12u1 | — |
| Debian 10 | qt4-x11 | 4:4.8.7+dfsg-18+deb10u2 | DLA-3539-1 |
| Debian 10 | qtbase-opensource-src | 5.11.3+dfsg1-1+deb10u6 | DLA-3805-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | qt6-base | No fix yet | — |
| Ubuntu 26.04 LTS | qt6-base | No fix yet | — |
| Ubuntu 25.10 | qt6-base | No fix yet | — |
| Ubuntu 24.04 LTS | qt6-base | No fix yet | — |
| Ubuntu 22.04 LTS | qt6-base | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | qt5 +3 | 5.15.9-1.el9 | RHSA-2023:6369 |
| RHEL 9 | qt5-qtbase +9 | 5.15.9-7.el9 | RHSA-2023:6369 |
| RHEL 8 | qt5-qtbase +9 | 5.15.3-5.el8 | RHSA-2023:6967 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | qt5 +3 | 5.15.9-1.el9 | ALSA-2023:6369 |
| AlmaLinux 9 | qt5-qtbase +9 | 5.15.9-7.el9 | ALSA-2023:6369 |
| AlmaLinux 8 | qt5-qtbase +9 | 5.15.3-5.el8 | ALSA-2023:6967 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | adwaita-qt | 1.4.2-1.el9 | RLSA-2023:6369 |
| Rocky Linux 9 | python-pyqt5-sip | 12.11.1-1.el9.0.1 | RLSA-2023:6369 |
| Rocky Linux 9 | qgnomeplatform | 0.9.0-1.el9 | RLSA-2023:6369 |
| Rocky Linux 9 | qt5 +17 | 5.15.9-1.el9 | RLSA-2023:6369 |
| Rocky Linux 9 | qt5-qtdeclarative | 5.15.9-3.el9 | RLSA-2023:6369 |
| Rocky Linux 9 | qt5-qtsvg +3 | 5.15.9-2.el9 | RLSA-2023:6369 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | libqt5-qtbase | 5.15.8+kde185-150500.4.8.1 | SUSE-SU-2023:3018-1 |
| SLES 15 SP5 | qt6-base | 6.4.2-150500.3.7.4 | SUSE-SU-2023:3225-1 |
| SLES 15 SP4 | libqt5-qtbase | 5.15.2+kde294-150400.6.6.1 | SUSE-SU-2023:2982-1 |
| SLES 15 SP4 | qt6-base | 6.2.2-150400.4.6.1 | SUSE-SU-2023:3380-1 |
| SLES 15 SP3 | libqt5-qtbase | 5.12.7-150200.4.23.1 | SUSE-SU-2023:3207-1 |
| SLES 15 SP2 | libqt5-qtbase | 5.12.7-150200.4.23.1 | SUSE-SU-2023:3207-1 |
| SLES 12 SP5 | libqt4 +2 | 4.8.7-8.19.1 | SUSE-SU-2025:02968-1, SUSE-SU-2023:4622-1 |
| SLES 12 SP5 | libqt5-qtbase | 5.6.2-6.36.1 | SUSE-SU-2023:2971-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | libqt5-qtbase | 5.12.7-150200.4.23.1 | SUSE-SU-2023:3207-1 |
| SLES for SAP 15 SP2 | libqt5-qtbase | 5.12.7-150200.4.23.1 | SUSE-SU-2023:3207-1 |
| SLES for SAP 12 SP5 | libqt4 +2 | 4.8.7-8.19.1 | SUSE-SU-2023:4622-1 |
| SLES for SAP 12 SP5 | libqt5-qtbase | 5.6.2-6.36.1 | SUSE-SU-2023:2971-1 |
| SLE HPC 15 SP3 | libqt5-qtbase | 5.12.7-150200.4.23.1 | SUSE-SU-2023:3207-1 |
| SLE HPC 15 SP2 | libqt5-qtbase | 5.12.7-150200.4.23.1 | SUSE-SU-2023:3207-1 |
| SUSE Manager Server 4.2 | libqt5-qtbase | 5.12.7-150200.4.23.1 | SUSE-SU-2023:3207-1 |
| SUSE Manager Proxy 4.2 | libqt5-qtbase | 5.12.7-150200.4.23.1 | SUSE-SU-2023:3207-1 |
| SUSE Enterprise Storage 7.1 | libqt5-qtbase | 5.12.7-150200.4.23.1 | SUSE-SU-2023:3207-1 |
| SUSE Enterprise Storage 7 | libqt5-qtbase | 5.12.7-150200.4.23.1 | SUSE-SU-2023:3207-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libqt5-qtbase | 5.15.11+kde138-2.1 | openSUSE-SU-2024:13377-1 |
| openSUSE Tumbleweed | qt6-base | 6.5.2-1.1 | openSUSE-SU-2024:13079-1 |
| openSUSE Leap 15.5 | libqt5-qtbase | 5.15.8+kde185-150500.4.8.1 | SUSE-SU-2023:3018-1 |
| openSUSE Leap 15.5 | qt6-base | 6.4.2-150500.3.7.4 | SUSE-SU-2023:3225-1 |
| openSUSE Leap 15.5 | qt6-base-docs | 6.4.2-150500.3.7.1 | SUSE-SU-2023:3225-1 |
| openSUSE Leap 15.4 | libqt5-qtbase | 5.15.2+kde294-150400.6.6.1 | SUSE-SU-2023:2982-1 |
| openSUSE Leap 15.4 | qt6-base +1 | 6.2.2-150400.4.6.1 | SUSE-SU-2023:3380-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | qt +13 | 1:4.8.5-15.amzn2.0.9 | ALAS2-2025-2890 |
| Amazon Linux 2 | qt5-qtbase +10 | 5.9.2-3.amzn2.0.12 | ALAS2-2023-2252 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | qt5-qtbase | 5.12.11-9 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | adwaita-qt5 +1 | 1.4.2-1.el9 | ELSA-2023-6369 |
| Oracle Linux 9 | python3-pyqt5-sip | 12.11.1-1.el9 | ELSA-2023-6369 |
| Oracle Linux 9 | qgnomeplatform | 0.9.0-1.el9 | ELSA-2023-6369 |
| Oracle Linux 9 | qt5 +66 | 5.15.9-1.el9 | ELSA-2023-6369 |
| Oracle Linux 9 | qt5-qtbase +9 | 5.15.9-7.el9 | ELSA-2023-6369 |
| Oracle Linux 9 | qt5-qtsvg +11 | 5.15.9-2.el9 | ELSA-2023-6369 |
| Oracle Linux 9 | qt5-qttools +16 | 5.15.9-3.el9 | ELSA-2023-6369 |
| Oracle Linux 8 | qt5-qtbase +9 | 5.15.3-5.el8 | ELSA-2023-6967 |
Advisories 22
- ALSA-2023:6369 Moderate: qt5 security and bug fix update AlmaLinux Security Advisories · Nov 9, 2026
- ALSA-2023:6967 Moderate: qt5-qtbase security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2023:6369 Red Hat Security Advisory: qt5 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2023:6967 Red Hat Security Advisory: qt5-qtbase security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RLSA-2023:6369 Moderate: qt5 security and bug fix update Rocky Linux Security Advisories · Jun 25, 2026
- DLA-3539-1 qt4-x11 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3805-1 qtbase-opensource-src - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2023:3207-1 Security update for libqt5-qtbase SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13079-1 libQt6Concurrent6-6.5.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4622-1 Security update for libqt4 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:3380-1 Security update for qt6-base SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2982-1 Security update for libqt5-qtbase SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02968-1 Security update for libqt4 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13377-1 libQt5Bootstrap-devel-static-32bit-5.15.11+kde138-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2971-1 Security update for libqt5-qtbase SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:3018-1 Security update for libqt5-qtbase SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-1750 QT: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Aug 24, 2025
- ALAS2-2025-2890 Moderate: qt security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 12, 2025
- SUSE-SU-2023:3225-1 Security update for qt6-base SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2023-6967 Moderate: qt5-qtbase security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 17, 2023
- ELSA-2023-6369 Moderate: qt5 security and bug fix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 12, 2023
- ALAS2-2023-2252 Moderate: qt5-qtbase security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 20, 2023
References
- https://codereview.qt-project.org/c/qt/qtbase/+/488960
- FEDORA-2023-364ae10761 vendor-advisory
- FEDORA-2023-5ead27b6d2 vendor-advisory
- FEDORA-2023-ff372f9829 vendor-advisory
- [debian-lts-announce] 20230822 [SECURITY] [DLA 3539-1] qt4-x11 security update mailing-list
- [debian-lts-announce] 20240430 [SECURITY] [DLA 3805-1] qtbase-opensource-src security update mailing-list