Reachable Assertion Affecting qt6-qtbase-examples package, versions <0:6.8.1-9.el10_0


Severity

Recommended
0.0
medium
0
10

Based on CentOS security rating.

Threat Intelligence

EPSS
0.31% (23rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS10-QT6QTBASEEXAMPLES-10499516
  • published25 Jun 2025
  • disclosed2 Jun 2025

Introduced: 2 Jun 2025

CVE-2025-5455  (opens in a new tab)
CWE-617  (opens in a new tab)

How to fix?

Upgrade Centos:10 qt6-qtbase-examples to version 0:6.8.1-9.el10_0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream qt6-qtbase-examples package and not the qt6-qtbase-examples package as distributed by Centos. See How to fix? for Centos:10 relevant fixed versions and status.

An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code.

If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value (such as "data:charset,"), and Qt was built with assertions enabled, then it would hit an assertion, resulting in a denial of service (abort).

This impacts Qt up to 5.15.18, 6.0.0->6.5.8, 6.6.0->6.8.3 and 6.9.0. This has been fixed in 5.15.19, 6.5.9, 6.8.4 and 6.9.1.

CVSS Base Scores

version 3.1