Security update for libqt5-qt3d

2024-08-2007:17:52

Google

osv.dev

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

This update for libqt5-qt3d fixes the following issues:

CVE-2024-40724: Fixed heap-based buffer overflow in the PLY importer class in assimp (bsc#1228204)

Other fixes:

Check for a nullptr returned from the shader manager
Fill image with transparency by default to avoid having junk if it’s not filled properly before the first paint call
Fix QTextureAtlas parenting that could lead to crashes due to being used after free’d.