Skip to content
OpenAdvisories
Medium ALAS2-2025-3074 1 CVE

Moderate: qt5-qt3d security update (Amazon Linux 2)

Published Nov 10, 2025 · Updated Nov 10, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-11277: A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing manipulation can lead to heap-based buffer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be exploited.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 qt5-qt3d 0:5.15.3-1.amzn2.0.7
Amazon Linux · 2 qt5-qt3d-debuginfo 0:5.15.3-1.amzn2.0.7
Amazon Linux · 2 qt5-qt3d-devel 0:5.15.3-1.amzn2.0.7
Amazon Linux · 2 qt5-qt3d-examples 0:5.15.3-1.amzn2.0.7

Vulnerabilities 1

  • Medium 5.3
    CVE-2025-11277

    Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile heap-based overflow

    A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipulation can lead to heap-based buffer overflow. The attack nee…

    Open Asset Import Library Assimp assimp assimp Debian Ubuntu Alpine PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-11277.html