Skip to content
OpenAdvisories
Medium ALAS2-2023-2252 2 CVEs

Moderate: qt5-qtbase security update (Amazon Linux 2)

Published Sep 13, 2023 · Updated Sep 20, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-38197: An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion. CVE-2022-25634: Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.

Fixed packages 12

ReleasePackageFixed in
Amazon Linux · 2 qt5-qtbase 0:5.9.2-3.amzn2.0.12
Amazon Linux · 2 qt5-qtbase-common 0:5.9.2-3.amzn2.0.12
Amazon Linux · 2 qt5-qtbase-debuginfo 0:5.9.2-3.amzn2.0.12
Amazon Linux · 2 qt5-qtbase-devel 0:5.9.2-3.amzn2.0.12
Amazon Linux · 2 qt5-qtbase-doc 0:5.9.2-3.amzn2.0.12
Amazon Linux · 2 qt5-qtbase-examples 0:5.9.2-3.amzn2.0.12
Amazon Linux · 2 qt5-qtbase-gui 0:5.9.2-3.amzn2.0.12
Amazon Linux · 2 qt5-qtbase-mysql 0:5.9.2-3.amzn2.0.12
Amazon Linux · 2 qt5-qtbase-odbc 0:5.9.2-3.amzn2.0.12
Amazon Linux · 2 qt5-qtbase-postgresql 0:5.9.2-3.amzn2.0.12
Amazon Linux · 2 qt5-qtbase-static 0:5.9.2-3.amzn2.0.12
Amazon Linux · 2 qt5-rpm-macros 0:5.9.2-3.amzn2.0.12

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-25634.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-38197.html