Your message dated Sat, 17 Oct 2026 15:37:32 +0000
with message-id <[email protected]>
and subject line Bug#1149994: fixed in qt6-base 6.11.2+dfsg-6
has caused the Debian Bug report #1149994,
regarding qt6-base: CVE-2026-15037
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149994: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149994
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: qt6-base
Version: 6.11.2+dfsg-5
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for qt6-base.
CVE-2026-15037[0]:
| Improper output neutralization (XML injection) in QDom comment,
| CDATA, and processing-instruction serialization in Qt XML from 4.0.0
| through 6.11 allows untrusted text serialized by an application into
| those nodes to inject arbitrary XML markup, because the node
| terminators are not escaped under the default InvalidDataPolicy
| (AcceptInvalidChars). Fixed in Qt 6.12.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-15037
https://www.cve.org/CVERecord?id=CVE-2026-15037
[1] https://codereview.qt-project.org/c/qt/qtbase/+/748323
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: qt6-base
Source-Version: 6.11.2+dfsg-6
Done: Patrick Franz <[email protected]>
We believe that the bug you reported is fixed in the latest version of
qt6-base, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Patrick Franz <[email protected]> (supplier of updated qt6-base package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 17 Oct 2026 17:03:24 +0200
Source: qt6-base
Architecture: source
Version: 6.11.2+dfsg-6
Distribution: unstable
Urgency: medium
Maintainer: Debian Qt/KDE Maintainers <[email protected]>
Changed-By: Patrick Franz <[email protected]>
Closes: 1149994 1150389
Changes:
qt6-base (6.11.2+dfsg-6) unstable; urgency=medium
.
[ Patrick Franz ]
* Switch the libmd4c-html0-dev B-D to libmd4c-html-dev as the package
has been renamed.
* Add patch to fix detecting 64-bit SPARC when building with GCC
(Closes: #1150389).
* Backport patch to fix CVE-2026-15037 (Closes: #1149994).
Checksums-Sha1:
cfcc44093369ed8159f4ce4ed7434c5410337090 6020 qt6-base_6.11.2+dfsg-6.dsc
471ebbca0a2bf3075e32120d5c9cccd04c82d622 207136
qt6-base_6.11.2+dfsg-6.debian.tar.xz
b0f871d948c45e29a89056693067e3150e3500a1 9058
qt6-base_6.11.2+dfsg-6_source.buildinfo
Checksums-Sha256:
e4bf8395c7eda9d3d99acc3d3b0d3026eedcdc3784181097aadd4433b27e6993 6020
qt6-base_6.11.2+dfsg-6.dsc
8358a1b4d48eea51bcf4399f25421c9701e0337256f7de6270cae843b451c2a4 207136
qt6-base_6.11.2+dfsg-6.debian.tar.xz
9d111f5855742f334b860e0e9a5cc5e4e3c6861de152e1b038d6ec41e06c63f3 9058
qt6-base_6.11.2+dfsg-6_source.buildinfo
Files:
f1fe99496a6345754636065233ccb977 6020 libs optional qt6-base_6.11.2+dfsg-6.dsc
174d6c55f7ceb9e155be27ee71ed94ec 207136 libs optional
qt6-base_6.11.2+dfsg-6.debian.tar.xz
bae1e5b15e86a0491a39b74e24893357 9058 libs optional
qt6-base_6.11.2+dfsg-6_source.buildinfo
-----BEGIN PGP SIGNATURE-----
wsG7BAEBCgBvBYJq045hCRCen3pgMHf+VkcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmdEHmnZ+ilt8O4Y1NbP2wlSKR+05l7/eMtJ5lzKoDLz
zhYhBGKHQVw0evHMWR7typ6femAwd/5WAABIGA//Zi1eJyxNe4HpJr2OJH+6mb0e
56C6Nohz7hBHpKgAIVMOsK1DgZFQwQPEoP0eLURMD4Umo3QZWV5gOWhlAgqeIw1A
CRFtgLNteSXwNDUI5VzWgbLwb8tkIzG2dK3Wdk0uotAqPjOpNI1JwOzx5+W/tKRs
/Xdnb3AdJLg8fZTEd33vGdSXHlnNvJukdo0AsChmb9N0qOXC+rzsJeR7G7jI0v4/
+uAbRNSQDdKMiZikagiHwlnf0+IfU70ELur9KG5HY/8VFlHPQnrk70zFysuwtJ5E
EWD9dTx6iczl0jSfn7gNlCrufCMawI+i7Vj8o9ackLSrbf2DcsGR2HyYF/mVpiRH
Ul3utVMXlmRU+uvyES8fqVTF2wxzEevGnI+DMMjVrX5ugsNNdGx/4N7wZ8JsuiZw
0per7AlL7x0DXgkkXgZJXYkY0i02vvNnqy0qKGRQwQrox/XT2wqdgtzB9Zoocu9n
ShILzvffaarFhUqnDwf5eN/ciY+rAKby7SytUs02Q5MVhpBrbb2bmphHuKMNFi0W
nSvyfg8+zIpOxwdcpsURpSG5OJNVCKAWWQazGBfdZSkNkvOzeEZTNxAs9ibkYBw+
45dcXAx1PsM3onEsunPfHQhnqdRhKbXVQPNVzUZu1OhYcuGf8DdNW+kiXCB6BEbf
XIhfrk4AoMsblrBK9t8=
=LcRY
-----END PGP SIGNATURE-----
pgp8HQruPt6SS.pgp
Description: PGP signature
--- End Message ---
