Summary
It was discovered that Qt Declarative did not properly validate the
width and height attributes of image tags in the Text component of Qt
Quick. An attacker could possibly use this issue to cause Qt Declarative
to use excessive resources, leading to a denial of service.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | qtdeclarative-opensource-src | 5.12.8-0ubuntu1+esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | qtdeclarative-opensource-src | 5.15.3+dfsg-1ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | qtdeclarative-opensource-src | 5.15.13+dfsg-1ubuntu0.1+esm1 |
Vulnerabilities 1
-
High 8.7
Improper validation of <img> tag size in Text component parser
Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS, Linux, iOS, Android, x86, ARM, 64 bit, 32 bit allows Excessive Allocation. This issue affects users …
References
-
report
https://ubuntu.com/security/CVE-2025-12385