{"id":"CVE-2025-30348","aliases":["AZL-58948","AZL-58958","DEBIAN-CVE-2025-30348","EUVD-2025-7261","GHSA-hc3c-6xqp-r265","OESA-2025-1384","OESA-2025-1385","OESA-2025-1386","OESA-2025-1387","OESA-2025-1493","OESA-2025-1494","SUSE-SU-2025:03599-1","SUSE-SU-2025:3723-1","UBUNTU-CVE-2025-30348"],"status":"published","title":"encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and...","description":"encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).","severity":{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00369,"percentile":0.30961,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-407"],"published":"2025-03-21T00:00:00Z","modified":"2026-11-06T13:51:09Z","fixes":[{"ecosystem":"Azure Linux:2","package":"qt5-qtbase","fixed_in":["5.12.11-16"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"qtbase","fixed_in":["6.6.3-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qt6-base","fixed_in":["6.8.2+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qt6-base","fixed_in":["6.8.2+dfsg-5"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"qt5-qtbase","fixed_in":["5.15.2-17.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"qt5-qtbase","fixed_in":["5.15.2-17.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"qt5-qtbase","fixed_in":["5.15.10-11.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"qt5-qtbase","fixed_in":["5.15.10-11.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"qt6-qtbase","fixed_in":["6.5.2-10.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"qt6-qtbase","fixed_in":["6.5.2-10.oe2403sp1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.11-16"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.2+dfsg-1","6.10.2+dfsg-10","6.10.2+dfsg-10+hurd.1","6.10.2+dfsg-11","6.10.2+dfsg-12","6.10.2+dfsg-13","6.10.2+dfsg-14","6.10.2+dfsg-15","6.10.2+dfsg-16","6.10.2+dfsg-2","6.10.2+dfsg-3","6.10.2+dfsg-4","6.10.2+dfsg-5","6.10.2+dfsg-6","6.10.2+dfsg-7","6.10.2+dfsg-7+hurd.1","6.10.2+dfsg-8","6.10.2+dfsg-9","6.11.2+dfsg-1","6.11.2+dfsg-2","6.11.2+dfsg-3","6.11.2+dfsg-4","6.4.2+dfsg-10","6.4.2+dfsg-11","6.4.2+dfsg-11~bpo11+1","6.4.2+dfsg-12","6.4.2+dfsg-13","6.4.2+dfsg-14","6.4.2+dfsg-15","6.4.2+dfsg-16","6.4.2+dfsg-17","6.4.2+dfsg-18","6.4.2+dfsg-18+loong64","6.4.2+dfsg-19","6.4.2+dfsg-20","6.4.2+dfsg-21","6.4.2+dfsg-21.1","6.6.0+dfsg-1","6.6.0+dfsg-2","6.6.0+dfsg-3","6.6.0+dfsg-4","6.6.0+dfsg-5","6.6.0+dfsg-6","6.6.1+dfsg-1","6.6.1+dfsg-2","6.6.1+dfsg-3","6.6.1+dfsg-4","6.6.1+dfsg-5","6.6.1+dfsg-6","6.6.2+dfsg-1","6.6.2+dfsg-10","6.6.2+dfsg-11","6.6.2+dfsg-12","6.6.2+dfsg-2","6.6.2+dfsg-3","6.6.2+dfsg-4","6.6.2+dfsg-5","6.6.2+dfsg-6","6.6.2+dfsg-7","6.6.2+dfsg-8","6.6.2+dfsg-9","6.7.2+dfsg-1","6.7.2+dfsg-2","6.7.2+dfsg-3","6.7.2+dfsg-4","6.7.2+dfsg-4+m68k","6.7.2+dfsg-5","6.7.2+dfsg-6","6.8.2+dfsg-1","6.8.2+dfsg-10","6.8.2+dfsg-10.1","6.8.2+dfsg-2","6.8.2+dfsg-3","6.8.2+dfsg-4","6.8.2+dfsg-5","6.8.2+dfsg-5+m68k","6.8.2+dfsg-6","6.8.2+dfsg-7","6.8.2+dfsg-8","6.8.2+dfsg-9","6.9.1+dfsg-1","6.9.1+dfsg-2","6.9.1+dfsg-3","6.9.1+dfsg-4","6.9.1+dfsg-5","6.9.2+dfsg-1","6.9.2+dfsg-2","6.9.2+dfsg-3","6.9.2+dfsg-4"]},{"source":"osv","ecosystem":"Debian:13","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.2+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.2+dfsg-5"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-17.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-17.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.10-11.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.10-11.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"qt6-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-10.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"qt6-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-10.oe2403sp1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"qt6-base-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"qt6-base-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"qt6-base-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.12+kde151-150600.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.12+kde151-150600.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.12+kde151-150600.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.12+kde151-150600.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.12+kde151-150600.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2+dfsg-2ubuntu9","5.5.1+dfsg-6ubuntu4","5.5.1+dfsg-10ubuntu2","5.5.1+dfsg-13ubuntu1","5.5.1+dfsg-13ubuntu2","5.5.1+dfsg-13ubuntu3","5.5.1+dfsg-14ubuntu1","5.5.1+dfsg-14ubuntu2","5.5.1+dfsg-14ubuntu3","5.5.1+dfsg-15ubuntu1","5.5.1+dfsg-16ubuntu1","5.5.1+dfsg-16ubuntu6","5.5.1+dfsg-16ubuntu7","5.5.1+dfsg-16ubuntu7.1","5.5.1+dfsg-16ubuntu7.2","5.5.1+dfsg-16ubuntu7.5","5.5.1+dfsg-16ubuntu7.6","5.5.1+dfsg-16ubuntu7.7","5.5.1+dfsg-16ubuntu7.7+esm1","5.5.1+dfsg-16ubuntu7.7+esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2+dfsg-2ubuntu9","5.5.1+dfsg-6ubuntu1","5.5.1+dfsg-10ubuntu1","5.5.1+dfsg-13ubuntu1","5.5.1+dfsg-13ubuntu2","5.5.1+dfsg-13ubuntu3","5.5.1+dfsg-14ubuntu1","5.5.1+dfsg-14ubuntu2","5.5.1+dfsg-14ubuntu3","5.5.1+dfsg-15ubuntu1","5.5.1+dfsg-16ubuntu1","5.5.1+dfsg-16ubuntu4","5.5.1+dfsg-16ubuntu5","5.5.1+dfsg-16ubuntu6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.1+dfsg-10ubuntu1","5.9.1+dfsg-10ubuntu2","5.9.2+dfsg-4ubuntu6","5.9.3+dfsg-0ubuntu1","5.9.3+dfsg-0ubuntu3","5.9.3+dfsg-0ubuntu4","5.9.4+dfsg-0ubuntu3","5.9.4+dfsg-0ubuntu4","5.9.5+dfsg-0ubuntu1","5.9.5+dfsg-0ubuntu2","5.9.5+dfsg-0ubuntu2.1","5.9.5+dfsg-0ubuntu2.3","5.9.5+dfsg-0ubuntu2.4","5.9.5+dfsg-0ubuntu2.5","5.9.5+dfsg-0ubuntu2.6","5.9.5+dfsg-0ubuntu2.6+esm1","5.9.5+dfsg-0ubuntu2.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.12.4+dfsg-4ubuntu1","5.12.5+dfsg-2","5.12.5+dfsg-8","5.12.5+dfsg-8build1","5.12.5+dfsg-9build1","5.12.8+dfsg-0ubuntu1","5.12.8+dfsg-0ubuntu2.1","5.12.8+dfsg-0ubuntu2.1+esm1","5.12.8+dfsg-0ubuntu2.1+esm2","5.12.8+dfsg-0ubuntu2.1+esm3","5.12.8+dfsg-0ubuntu2.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.12.4+dfsg-1build1","5.12.5+dfsg-1","5.12.5+dfsg-2","5.12.8+dfsg-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.2+dfsg-5ubuntu1","6.2.2+dfsg-6ubuntu1","6.2.2+dfsg-6ubuntu2","6.2.4+dfsg-1ubuntu1","6.2.4+dfsg-2ubuntu1","6.2.4+dfsg-2ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.2+dfsg-12","5.15.2+dfsg-13","5.15.2+dfsg-14","5.15.2+dfsg-14ubuntu1","5.15.2+dfsg-14ubuntu3","5.15.2+dfsg-15","5.15.3+dfsg-1","5.15.3+dfsg-2","5.15.3+dfsg-2ubuntu0.1","5.15.3+dfsg-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.2+dfsg-4","5.15.2+dfsg-5","5.15.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.2+dfsg-12","5.15.2+dfsg-13","5.15.2+dfsg-14","5.15.2+dfsg-14ubuntu1","5.15.2+dfsg-14ubuntu3","5.15.2+dfsg-15","5.15.3+dfsg-1","5.15.3+dfsg-2","5.15.3+dfsg-2ubuntu0.1","5.15.3+dfsg-2ubuntu0.2","5.15.3+dfsg-2ubuntu0.2+esm1","5.15.3+dfsg-2ubuntu0.2+esm2","5.15.3+dfsg-2ubuntu0.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.2+dfsg-18","6.4.2+dfsg-19","6.4.2+dfsg-19build1","6.4.2+dfsg-20","6.4.2+dfsg-21","6.4.2+dfsg-21.1build4","6.4.2+dfsg-21.1build5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.10+dfsg-3","5.15.10+dfsg-5","5.15.10+dfsg-5ubuntu1","5.15.12+dfsg-1ubuntu1","5.15.12+dfsg-3ubuntu1","5.15.12+dfsg-3ubuntu6","5.15.12+dfsg-3ubuntu7","5.15.13+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.10+dfsg-2","5.15.10+dfsg-3","5.15.12+dfsg-1","5.15.12+dfsg-1ubuntu1","5.15.12+dfsg-1ubuntu2","5.15.13+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.10+dfsg-3","5.15.10+dfsg-5","5.15.10+dfsg-5ubuntu1","5.15.12+dfsg-1ubuntu1","5.15.12+dfsg-3ubuntu1","5.15.12+dfsg-3ubuntu6","5.15.12+dfsg-3ubuntu7","5.15.13+dfsg-1ubuntu1","5.15.13+dfsg-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-4ubuntu1","5.15.15+dfsg-5ubuntu1","5.15.17+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-2","5.15.17+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.18+dfsg-1ubuntu1","5.15.19+dfsg-2ubuntu1","5.15.19+dfsg-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.18+dfsg-1","5.15.19+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.17+dfsg-1ubuntu1","5.15.17+dfsg-1ubuntu2","5.15.18+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.17+dfsg-1","5.15.17+dfsg-2","5.15.18+dfsg-1"]}],"products":[{"vendor":"qt","product":"qt"},{"vendor":"the qt company","product":"qt"}],"references":[{"url":"https://codereview.qt-project.org/c/qt/qtbase/+/581442","tags":["Patch","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30348","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-hc3c-6xqp-r265"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30348.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-30348","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1384","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1385","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1386","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1387","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1493","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1494","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503599-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239896","tags":["report"]},{"url":"https://bugzilla.suse.com/1243958","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5455","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253723-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-30348","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-30348","tags":["report"]},{"url":"https://github.com/qt/qtbase/commit/2ce08e3671b8d18b0284447e5908ce15e6e8f80f","tags":["report"]},{"url":"https://github.com/qt/qtbase/commit/225e235cf966a44af23dbe9aaaa2fd20ab6430ee","tags":["report"]},{"url":"https://bugreports.qt.io/browse/QTBUG-127549","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-30348","description":"encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).","status":"published","published":"2025-03-21T00:00:00Z","modified":"2025-03-21T15:51:56.127Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:32:35.418416Z"}],"euvd":[{"id":"EUVD-2025-7261","description":"encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).","status":"published","published":"2025-03-21T00:00:00Z","modified":"2025-03-21T15:51:56Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:56.049523Z"}],"ghsa":[{"id":"GHSA-hc3c-6xqp-r265","title":"encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and...","description":"encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).","status":"published","published":"2025-03-21T09:30:34Z","modified":"2025-03-21T09:30:41Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:00:23.592031Z"}],"nvd":[{"id":"CVE-2025-30348","description":"encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).","status":"published","published":"2025-03-21T07:15:37.673Z","modified":"2026-06-17T09:08:33.43Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:10:54.744127Z"}],"osv":[{"id":"AZL-58948","title":"CVE-2025-30348 affecting package qt5-qtbase for versions less than 5.12.11-16","description":"encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).","status":"published","published":"2025-03-21T07:15:37Z","modified":"2026-04-21T04:37:10.338455Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:07.517393Z"},{"id":"AZL-58958","title":"CVE-2025-30348 affecting package qtbase for versions less than 6.6.3-3","description":"encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).","status":"published","published":"2025-03-21T07:15:37Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-05T16:41:21.344052Z"},{"id":"CVE-2025-30348","description":"encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).","status":"published","published":"2025-03-21T00:00:00Z","modified":"2026-10-28T10:58:59.100088092Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"DEBIAN-CVE-2025-30348","description":"encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).","status":"published","published":"2025-03-21T07:15:37.673Z","modified":"2026-09-01T20:05:45.576134532Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"OESA-2025-1384","title":"qt5-qtbase security update","description":"Qt is a software toolkit for developing applications.\r\n\r\nSecurity Fix(es):\n\nencodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).(CVE-2025-30348)","status":"published","published":"2025-04-11T11:08:28Z","modified":"2026-08-18T01:17:51.366304502Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1385","title":"qt5-qtbase security update","description":"Qt is a software toolkit for developing applications.\r\n\r\nSecurity Fix(es):\n\nencodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).(CVE-2025-30348)","status":"published","published":"2025-04-11T11:08:28Z","modified":"2026-08-18T01:17:51.488910393Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1386","title":"qt5-qtbase security update","description":"Qt is a software toolkit for developing applications.\r\n\r\nSecurity Fix(es):\n\nencodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).(CVE-2025-30348)","status":"published","published":"2025-04-11T11:08:29Z","modified":"2026-08-18T01:17:51.469384654Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1387","title":"qt5-qtbase security update","description":"Qt is a software toolkit for developing applications.\r\n\r\nSecurity Fix(es):\n\nencodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).(CVE-2025-30348)","status":"published","published":"2025-04-11T11:08:29Z","modified":"2026-08-18T01:17:51.443393599Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1493","title":"qt6-qtbase security update","description":"Qt is a software toolkit for developing applications.\r\n\r\nSecurity Fix(es):\n\nencodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).(CVE-2025-30348)","status":"published","published":"2025-05-09T11:08:35Z","modified":"2026-08-18T01:17:52.37571338Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1494","title":"qt6-qtbase security update","description":"Qt is a software toolkit for developing applications.\r\n\r\nSecurity Fix(es):\n\nencodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).(CVE-2025-30348)","status":"published","published":"2025-05-09T11:08:35Z","modified":"2026-08-18T01:17:52.425453507Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2025-30348","description":"encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).","status":"published","published":"2025-03-21T07:15:00Z","modified":"2026-11-06T13:51:09.458752149Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-06T14:23:26.398644Z"},{"id":"SUSE-SU-2025:03599-1","title":"Security update for qt6-base","description":"This update for qt6-base fixes the following issues:\n\n- CVE-2025-5455: processing of malformed data in `qDecodeDataUrl()` can trigger assertion and cause a crash\n  (bsc#1243958).\n- CVE-2025-30348: complex algorithm used in `encodeText` in QDom when processing XML data can cause low performance\n  (bsc#1239896).\n","status":"published","published":"2025-10-15T12:17:03Z","modified":"2026-03-23T04:48:05.862448Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:3723-1","title":"Security update for libqt5-qtbase","description":"This update for libqt5-qtbase fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-5455: processing of malformed data in `qDecodeDataUrl()` can trigger assertion and cause a crash\n  (bsc#1243958).\n- CVE-2025-30348: complex algorithm used in `encodeText` in QDom when processing XML data can cause low performance\n  (bsc#1239896).\n\nOther issues fixed:\n   \n- Initialize a member variable in `QObjectPrivate::Signal` that was uninitialized under some circumstances.\n- Fix a crash when parsing a particular glyph in a particular font.\n- Avoid repeatedly registering xsettings callbacks when switching cursor themes.\n- Check validity of RandR output info before using it.\n- Fix reparenting a window so it takes effect even if there are no other state changes to the window.\n","status":"published","published":"2025-10-22T11:22:11Z","modified":"2026-02-04T04:36:08.712623Z","updated_at":"2026-11-02T15:54:00.344164Z"}]}}