dev-qt/qtbase-6.12.0 — Security Advisories

▸ GLSA 202506-06 Qt: Multiple Vulnerabilities this version unaffected high local 2025-06-12

Multiple vulnerabilities have been discovered in Qt, the worst of which can lead to arbitrary code execution.

Announced: 2025-06-12
Revised: 2025-06-12
Access: local
Bugs: #924647 #931096 #935869 #954261
Advisory: https://security.gentoo.org/glsa/202506-06

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-qt/qtbase	*	< 6.8.3-r1	>= 6.8.3-r1
dev-qt/qtgui	*	< 5.15.12-r2	>= 5.15.12-r2
dev-qt/qtnetwork	*	< 5.15.14-r1	>= 5.15.14-r1

Background

Qt is a cross-platform application development framework.

Description

Multiple vulnerabilities have been discovered in Qt. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All Qt users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-qt/qtbase-6.8.3-r1"
# emerge --ask --oneshot --verbose ">=dev-qt/qtnetwork-5.15.14-r1"
# emerge --ask --oneshot --verbose ">=dev-qt/qtgui-5.15.12-r2"

References

▸ GLSA 202501-08 Qt: Buffer Overflow this version unaffected normal local 2025-01-23

A vulnerability has been discovered in Qt, where a buffer overflow can lead to denial of service.

Announced: 2025-01-23
Revised: 2025-01-23
Access: local
Bugs: #911790
Advisory: https://security.gentoo.org/glsa/202501-08

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-qt/qtbase	*	< 6.5.2	>= 6.5.2
dev-qt/qtcore	*	< 5.15.10-r1	>= 5.15.10-r1

Background

Qt is a cross-platform application development framework.

Description

When given specifically crafted data then QXmlStreamReader can end up causing a buffer overflow and subsequently a crash or freeze or get out of memory on recursive entity expansion, with DTD tokens in XML body.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All Qt users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-qt/qtcore-5.15.10-r1"
# emerge --ask --oneshot --verbose ">=dev-qt/qtbase-6.5.2"

References

▸ GLSA 202402-21 QtNetwork: Multiple Vulnerabilities this version unaffected high local and remote 2024-02-18

Multiple vulnerabilities have been discovered in QtNetwork, the worst of which could lead to execution of arbitrary code.

Announced: 2024-02-18
Revised: 2024-02-18
Access: local and remote
Bugs: #907120 #921292
Advisory: https://security.gentoo.org/glsa/202402-21

Affected packages

Package	Arch	Vulnerable	Unaffected
dev-qt/qtbase	*	< 6.6.1-r2	>= 6.6.1-r2
dev-qt/qtnetwork	*	< 5.15.12-r1	>= 5.15.12-r1

Background

QtNetwork provides a set of APIs for programming applications that use TCP/IP. It is part of the Qt framework.

Description

Multiple vulnerabilities have been discovered in QtNetwork. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All Qt 5 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-qt/qtnetwork-5.15.12-r1"

All Qt 6 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-qt/qtbase-6.6.1-r2"