Most recent entries from all

ALSA-2025:9462 — Moderate: qt5-qtbase security update

Affected: AlmaLinux:9: qt5-qtbase, AlmaLinux:9: qt5-qtbase-common, AlmaLinux:9: qt5-qtbase-devel, AlmaLinux:9: qt5-qtbase-examples, AlmaLinux:9: qt5-qtbase-gui, AlmaLinux:9: qt5-qtbase-mysql, AlmaLinux:9: qt5-qtbase-odbc, AlmaLinux:9: qt5-qtbase-postgresql, AlmaLinux:9: qt5-qtbase-private-devel, AlmaLinux:9: qt5-qtbase-static

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.

Security Fix(es):

* qt5: qt6: QtCore Assertion Failure Denial of Service (CVE-2025-5455)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-06498

EUVD-2026-342265

fkie_cve-2025-5455

An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.

If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort).

This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.

GHSA-5cfg-qhv9-4842

An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.

This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.

msrc_CVE-2025-5455 — Possible denial of service when passing malformed data in a URL to qDecodeDataUrl

msrc_CVE-2025-5455

OESA-2025-1654 — qt5-qtbase security update

Affected: openEuler:22.03-LTS-SP3: qt5-qtbase, openEuler:22.03-LTS-SP4: qt5-qtbase, openEuler:24.03-LTS: qt5-qtbase, openEuler:24.03-LTS-SP1: qt5-qtbase, openEuler:20.03-LTS-SP4: qt5-qtbase

Qt is a software toolkit for developing applications. Security Fix(es):

An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.

This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.(CVE-2025-5455)

RHSA-2025:11841 — Red Hat Security Advisory: qt5-qtbase security update

qt6-qtbase: qt5-qtbase: QtCore Assertion Failure Denial of Service

RHSA-2025:9462 — Red Hat Security Advisory: qt5-qtbase security update

qt6-qtbase: qt5-qtbase: QtCore Assertion Failure Denial of Service

SUSE-SU-2025:02968-1 — Security update for libqt4

Security update for libqt4

UBUNTU-CVE-2025-5455

Affected: Ubuntu:Pro:16.04:LTS: qtbase-opensource-src, Ubuntu:16.04:LTS: qtbase-opensource-src-gles, Ubuntu:Pro:18.04:LTS: qtbase-opensource-src, Ubuntu:Pro:20.04:LTS: qtbase-opensource-src, Ubuntu:20.04:LTS: qtbase-opensource-src-gles, Ubuntu:22.04:LTS: qt6-base, Ubuntu:22.04:LTS: qtbase-opensource-src, Ubuntu:22.04:LTS: qtbase-opensource-src-gles, Ubuntu:24.04:LTS: qt6-base, Ubuntu:24.04:LTS: qtbase-opensource-src and 5 more

An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort). This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.

WID-SEC-W-2025-1220 — QT: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in QT ausnutzen, um einen Denial of Service Angriff durchzuführen.