SB20251022163 - SUSE update for libqt5-qtbase

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Resource exhaustion (CVE-ID: CVE-2025-30348)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper control of internal resources consumption in QDomNode::save() when parsing XML data. A remote attacker trigger resource exhaustion and perform a denial of service (DoS) attack.

2) Reachable assertion (CVE-ID: CVE-2025-5455)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion within the qDecodeDataUrl() function in QtCore. A remote attacker can pass a specially crafted data, such as URL with a "charset" parameter but without a value, and crash the application. 

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2025/suse-su-20253723-1/