ALT-PU-2023-1701-2

Package qt5-declarative updated to version 5.15.9-alt1 for branch sisyphus in task 319473.

Уязвимость пакета qt/qtbase библиотеки Qt, позволяющая нарушителю выполнить произвольный код

Severity: MEDIUM (6.5)Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Severity: HIGH (7.8)Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N

References:

CVE-2022-25255

Уязвимость функции LoadLibrary кроссплатформенного фреймворка для разработки программного обеспечения Qt, позволяющая нарушителю получить доступ к защищаемой информации

Severity: HIGH (7.5)Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Severity: HIGH (7.8)Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N

References:

CVE-2022-25634

In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.

Severity: HIGH (7.2)Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Severity: HIGH (7.8)Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.

Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Severity: HIGH (7.5)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Version: 2.1.2

Package qt5-declarative update in sisyphus on 2023-05-03

ALT-PU-2023-1701-2

Closed vulnerabilities

BDU:2022-00893

BDU:2023-05109

CVE-2022-25255

CVE-2022-25634