[ GLSA 202004-04 ] Qt WebEngine

[GLSA]

Gentoo Linux Security Advisory

Title: Qt WebEngine: Arbitrary code execution (GLSA 202004-04)
Severity: normal
Exploitable: local, remote
Date: 2020-04-01
Bug(s): #699328
ID: 202004-04

Synopsis

A heap use-after-free flaw in Qt WebEngine at worst might allow an
attacker to execute arbitrary code.


Background

Library for rendering dynamic web content in Qt5 C++ and QML
applications.


Affected Packages

Package: dev-qt/qtwebengine
Vulnerable: < 5.14.1
Unaffected: >= 5.14.1
Architectures: All supported architectures


Description

A use-after-free vulnerability has been found in the audio component of
Qt WebEngine.


Impact

A remote attacker could entice a user to open a specially crafted media
file in an application linked against Qt WebEngine, possibly resulting in
execution of arbitrary code with the privileges of the process or a
Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All Qt WebEngine users should upgrade to the latest version: