Bug 2417215 (CVE-2025-55174)

Summary: CVE-2025-55174 Skanpage: Skanpage: Partial file overwrite vulnerability due to incorrect I/O device usage
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Skanpage. This vulnerability allows an attacker to partially overwrite files, resulting in a file containing new content followed by partial old content, due to incorrect use of QIODevice::ReadWrite instead of QODevice::WriteOnly.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2417679, 2417680, 2417681    
Bug Blocks:    

Description OSIDB Bzimport 2025-11-26 06:01:23 UTC 
In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the partial contents of the old file at the end, because of use of QIODevice::ReadWrite instead of QODevice::WriteOnly.