CVE-2023-43114: 
NixOS vulnerability analysis and mitigation

An issue was discovered in Qt affecting multiple versions including Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 specifically on Windows systems. The vulnerability was disclosed on September 18, 2023, and involves the GDI font engine's handling of corrupted fonts (CVE Details).

The vulnerability occurs when using the GDI font engine on Windows systems. The issue manifests when a corrupted font is loaded via QFontDatabase::addApplicationFont{FromData] function, where missing length checks can trigger a crash. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

The primary impact of this vulnerability is on application availability. When successfully exploited, it can cause the affected application to crash due to improper handling of corrupted font data. The vulnerability has no direct impact on confidentiality or integrity of the system (NVD).

The vulnerability has been fixed in Qt versions 5.15.16, 6.2.10, and 6.5.3. Users are advised to upgrade to these or later versions to mitigate the vulnerability. The fix involves implementing proper length checks when processing font data (Qt Patch).