Joined: 12 May 2004
|Posted: Wed Apr 01, 2020 11:26 pm Post subject: [ GLSA 202004-04 ] Qt WebEngine
|Gentoo Linux Security Advisory
Title: Qt WebEngine: Arbitrary code execution (GLSA 202004-04)
Exploitable: local, remote
A heap use-after-free flaw in Qt WebEngine at worst might allow an
attacker to execute arbitrary code.
Library for rendering dynamic web content in Qt5 C++ and QML
Vulnerable: < 5.14.1
Unaffected: >= 5.14.1
Architectures: All supported architectures
A use-after-free vulnerability has been found in the audio component of
A remote attacker could entice a user to open a specially crafted media
file in an application linked against Qt WebEngine, possibly resulting in
execution of arbitrary code with the privileges of the process or a
Denial of Service condition.
There is no known workaround at this time.
All Qt WebEngine users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-qt/qtwebengine-5.14.1"