Opened 6 months ago
Closed 6 months ago
#22025 closed enhancement (fixed)
qt6-6.9.2 qtwebengine-6.9.2
| Reported by: | Bruce Dubbs | Owned by: | Douglas R. Reno |
|---|---|---|---|
| Priority: | high | Milestone: | 12.4 |
| Component: | BOOK | Version: | git |
| Severity: | critical | Keywords: | |
| Cc: |
Description
New point version.
Change History (3)
comment:1 by , 6 months ago
| Priority: | normal → high |
|---|---|
| Severity: | normal → critical |
comment:2 by , 6 months ago
| Milestone: | 12.5 → 12.4 |
|---|---|
| Owner: | changed from to |
| Status: | new → assigned |
Given the severity of the security vulnerabilities here and the significant danger to users with QtWebEngine and Udisks especially, I have been tasked with doing these updates.
I will be rebuilding all dependents of them and reporting back with the status of them after they are tested. For Qt, this includes rebuilding and retesting all of LXQt and KDE Plasma. I will be doing these in a branch for review first before they get merged in.
Libreoffice, while not security related, will be updated as well because of the critical crash fix. It also has a fix in there which allows for characters to be un-bolded/italicized after they have been bolded or italicized.
comment:3 by , 6 months ago
| Resolution: | → fixed |
|---|---|
| Status: | assigned → closed |
Fixed at 256dbd440fc5f494a4f5293405bec41528b8386a
SA-12.3-101 issued
The changes can be found at https://code.qt.io/cgit/qt/qtreleasenotes.git/about/qt/6.9.2/release-note.md
The two security issues mentioned in qtbase don't apply to us. The patch that's currently in BLFS 12.4 fixes CVE-2025-5992, and CVE-2025-6338 is Windows specific.
Now though we get to QtWebEngine. This is very serious, especially given the sandbox escape vulnerability which can significantly increase the impact of the vulnerabilities in this list. As an example, the sandbox escape vulnerability (CVE-2025-6558) could hypothetically allow CVE-2025-6554 to read a file from a user's system, or write one to an attacker controlled location. This combo is under active exploitation, and other distros such as Arch bumped their Qt packages to fix this in July.
QtWebEngine Security Fixes
In total, we have:
21 total vulnerabilities
I want to again re-emphasize CVE-2025-6558. This vulnerability is being actively exploited in the wild, and in our case we are severely vulnerable when using Falkon or other qtwebengine users such as khelpcenter. CVE-2025-6558 significantly increases the severity of the 12 remote code execution vulnerabilities, the arbitrary file read/write vulnerability, and the arbitrary code execution vulnerability... and can be exploited by visiting a crafted webpage or viewing crafted content, such as an advertisement or multimedia. https://thehackernews.com/2025/07/urgent-google-releases-critical-chrome.html is an article relating to that. Breaking out of the sandbox rips away most of the security layer that prevents vulnerabilities from damaging the underlying system. CVE-2025-6554 (the arbitrary file read/write vulnerability) is also known to be under active exploitation. https://thehackernews.com/2025/07/google-patches-critical-zero-day-flaw.html
It's worth noting as well that Arch bumped their version of Chromium for QtWebEngine on July 22nd to resolve several of these vulnerabilities as they get chained together.
I'm not entirely sure what to do about this. It can lead to severe consequences if the exploit chain occurs on a system running Falkon, and potentially in khelpcenter too if you somehow get a malicious HTML file to read through it's Online Help feature, which does connect to the internet and spins up it's own browser context. I don't know exactly how Plasma uses it, but kdeplasma-addons and plasma-nm use it.
Still though, if we update Qt6, we would need to retag:
That includes LXQt/KDE needing to be rebuilt and tested, which at this part of the cycle is harder for me to suggest. At the same time though, this is a very exceptional occasion.