Skip to content
OpenAdvisories
Medium ALAS2-2026-3335 5 CVEs

Moderate: qt5-qt3d security update (Amazon Linux 2)

Published Jun 8, 2026 · Updated Jun 8, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-70072: An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp, FBXConverter::ConvertMeshMultiMaterial() components CVE-2025-70071: An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray() CVE-2025-70070: An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXMeshGeometry.cpp, MeshGeometry::MeshGeometry() CVE-2025-70069: An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() method CVE-2025-70067: Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. The vulnerability occurs in aiMaterial::AddBinaryProperty, where a property key string from a crafted FBX file is copied into a fixed-size heap buffer using strcpy() without runtime length validation

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 qt5-qt3d 0:5.15.3-1.amzn2.0.9
Amazon Linux · 2 qt5-qt3d-debuginfo 0:5.15.3-1.amzn2.0.9
Amazon Linux · 2 qt5-qt3d-devel 0:5.15.3-1.amzn2.0.9
Amazon Linux · 2 qt5-qt3d-examples 0:5.15.3-1.amzn2.0.9

Vulnerabilities 5

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-70067.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-70069.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-70070.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-70071.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-70072.html