All ProjectsArch LinuxCommunity PackagesPacmanRelease Engineering Switch

Show Task #

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!

Tasklist

FS#79703 - [qt6-webengine] [security] (patch) CVE-2023-4863: libwebp: OOB write in BuildHuffmanTable

Task Type Bug Report Category Packages: Extra Status Closed Assigned To No-one Architecture All Severity High Priority Normal Reported Version Due in Version Undecided Due Date Undecided Percent Complete Votes 0 Private No

Details Earlier this week, Chrome released a fix for CVE-2023-4863: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html Note: "Google is aware that an exploit for CVE-2023-4863 exists in the wild." I'm assuming QtWebEngine is affected as well. Backport for Qt 6.5 is here: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/503192 https://code.qt.io/cgit/qt/qtwebengine-chromium.git/patch/?id=31f287a0142b6b78698504b528d35c9506dcdb43