BSD Portsqt6-webengine -- multiple vulnerabilities
· CVE-2025-13638, CVE-2025-13639, CVE-2025-13720, CVE-2025-14174, CVE-2025-14765, CVE-2026-0908, CVE-2026-1504 · VuXML entry
Qt qtwebengine-chromium repo reports: Backports for 7 security bugs in Chromium: CVE-2025-13638: Prevent media element GC in callbacks in WebMediaPlayerMS CVE-2025-13639: Improve validation of SDP direction in remote description CVE-2025-13720: Avoid downcasting Hash and Integrity reports CVE-2025-14174: Metal: Don't use pixelsDepthPitch to size buffers CVE-2025-14765: Polyfill unary negation and abs for amd mesa …
Affected versions
- qt6-pdf, qt6-webengine < 6.10.2
By system
0 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | print/qt6-pdf | 6.11.2 | fixed | |
| MidnightBSD | print/qt6-pdf | in range, by version | ||
| FreeBSD | www/qt6-webengine | 6.11.2 | fixed | |
| MidnightBSD | www/qt6-webengine | in range, by version |