Applying security patches
reddit / freebsd

----------------------------------------------------------------------
itaewonclass2020 · 2022-04-01 07:34

So I ran % pkg audit -F which resulted in finding a vulnerability in
qt5-core.

CVE: CVE-2022-25255

I found online what seems to be the patch for this specific CVE.

- How does one go about applying the patch?

- What file(s) do I need to download and commands ran to actually
patch the vulnerability?

- After patching the vulnerability does anything else need to be done?
( additional commands, recompile kernel, etc. )

Currently running FreeBSD-13.0-RELEASE-p10

According to QT, they “don’t see this as a considerable risk due to
the likely hood of it ( vulnerability ) being triggered is minimal.”

----------------------------------------------------------------------
FUZxxl · 2022-04-01 08:26

The vulnerability has been fixed in a ports tree commit from
2022-02-21.  Update your packages to apply the fix or update your
ports tree and recompile devel/qt5-core.

----------------------------------------------------------------------
PreviousWay · 2022-04-01 11:13

Doesn't it look like OP is using quarterly and going to cause ports
and package mix issues?

/u/itaewonclass2020

----------------------------------------------------------------------
a4qbfb · 2022-04-01 12:13

Unfortunately the patch wasn't merged to 2022Q1. But 2022Q2 should be
only days away.

----------------------------------------------------------------------
itaewonclass2020 · 2022-04-02 01:29

I guess I’ll just wait… not critical.