#22189 closed enhancement (fixed)
qt6 qtwebengine 6.9.3
| Reported by: | zeckma | Owned by: | Douglas R. Reno |
|---|---|---|---|
| Priority: | high | Milestone: | 13.0 |
| Component: | BOOK | Version: | git |
| Severity: | critical | Keywords: | |
| Cc: |
Description
QtWebEngine hasn't released version 6.9.3 yet, but has updated Chromium upstream which fixes several security vulnerabilities, of which two are rated as Critical which allow for remote arbitrary code execution (ACE).
Critical
- CVE-2025-8879: libaom heap buffer overflow, remote (High)
- CVE-2025-8880: ACE, remote (High)
- CVE-2025-8881: File picker allows leaking of cross-origin data via crafted HTML, remote (Medium)
- CVE-2025-8901: Out of bounds memory via crafted HTML, remote (High)
- CVE-2025-9866: Bypass content security policy via crafted HTML, remote (Medium)
- CVE-2025-10200: Use after free, heap corruption via crafted HTML, remote (Critical)
- CVE-2025-10201: Bypass site isolation via crafted HTML, remote (High)
- CVE-2025-10500: Use after free, Dawn (Reserved)
- CVE-2025-10501: Use after free, WebRTC (Reserved)
- CVE-2025-10502: Heap buffer overflow, ANGLE (Reserved)
- CVE-2025-10585: ACE, remote (Critical)
- CVE-2025-54874: Out of bounds heap memory write (related to OpenJPEG-2.5.4; see #22175) (Medium)
We need to make a patch to fix these vulnerabilities. 6.9.3 is scheduled to come out in 7 days, plus time it will take for testing. With two remote ACE vulnerabilities on the table, 7+ days is not an option.
Change History (7)
comment:1 by , 13 months ago
comment:2 by , 13 months ago
Because of that I think this needs to be treated as a sort of emergency.
comment:3 by , 13 months ago
| Owner: | changed from to |
|---|---|
| Status: | new → assigned |
comment:4 by , 13 months ago
| Summary: | QtWebEngine 6.9.2 - 6.9.3 vulnerabilities → qt6 qtwebengine 6.9.3 |
|---|
comment:5 by , 13 months ago
Some additional fixes:
- CVE-2025-10891: Integer overflow in V8 (8.8 High, RCE)
- CVE-2025-10892: Integer overflow in V8 (8.8 High, RCE)
- CVE-2025-10890: Side-channel information leakage in V8 (9.1 Critical, information leakage)
Changes for the rest of Qt can be found here: https://code.qt.io/cgit/qt/qtreleasenotes.git/tree/qt/6.9.3/release-note.md
No secfurity vulnerabilities in Qt itself though
comment:6 by , 13 months ago
| Resolution: | → fixed |
|---|---|
| Status: | assigned → closed |
Fixed at 361bfa7e7e9fb3cd27e2d440674876509a0fdeff
SA-12.4-013 issued
One question I asked myself when I first saw this was, "will 7 days really make a difference?"
CVE-2025-10585 was added to the US Government's Known Exploited Vulnerabilities Catalog approximately an hour ago. It's a type confusion issue in V8, which will allow for trivial remote code execution. Similar to the libaom issue, it will likely be rated as 10.0 Critical.