Skip to content
OpenAdvisories
High ALAS2-2025-3051 1 CVE

Important: qt5-qtsvg security update (Amazon Linux 2)

Published Oct 27, 2025 · Updated Oct 27, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-10729: The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 qt5-qtsvg 0:5.15.3-1.amzn2.0.2
Amazon Linux · 2 qt5-qtsvg-debuginfo 0:5.15.3-1.amzn2.0.2
Amazon Linux · 2 qt5-qtsvg-devel 0:5.15.3-1.amzn2.0.2
Amazon Linux · 2 qt5-qtsvg-examples 0:5.15.3-1.amzn2.0.2

Vulnerabilities 1

  • Critical 9.4
    CVE-2025-10729

    Use-after-free vulnerability in Qt SVG qsvghandler.cpp allows denial of service via crafted SVG

    The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.

    Qt Project Qt qt5-qtsvg qt6-svg Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-10729.html