Skip to content
OpenAdvisories
Medium ALAS2-2020-1397 3 CVEs

Moderate: qt5-qtbase security update (Amazon Linux 2)

Published Feb 24, 2020 · Updated Feb 27, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-19873: An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data. 1658998: CVE-2018-19873 qt5-qtbase: QBmpHandler segmentation fault on malformed BMP file CVE-2018-19870: An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler resulting in a segmentation fault. 1658996: CVE-2018-19870 qt5-qtbase: QImage allocation failure in qgifhandler CVE-2018-15518: QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML document. 1659000: CVE-2018-15518 qt5-qtbase: Double free in QXmlStreamReader

Fixed packages 12

ReleasePackageFixed in
Amazon Linux · 2 qt5-qtbase 0:5.9.2-3.amzn2.0.2
Amazon Linux · 2 qt5-qtbase-common 0:5.9.2-3.amzn2.0.2
Amazon Linux · 2 qt5-qtbase-debuginfo 0:5.9.2-3.amzn2.0.2
Amazon Linux · 2 qt5-qtbase-devel 0:5.9.2-3.amzn2.0.2
Amazon Linux · 2 qt5-qtbase-doc 0:5.9.2-3.amzn2.0.2
Amazon Linux · 2 qt5-qtbase-examples 0:5.9.2-3.amzn2.0.2
Amazon Linux · 2 qt5-qtbase-gui 0:5.9.2-3.amzn2.0.2
Amazon Linux · 2 qt5-qtbase-mysql 0:5.9.2-3.amzn2.0.2
Amazon Linux · 2 qt5-qtbase-odbc 0:5.9.2-3.amzn2.0.2
Amazon Linux · 2 qt5-qtbase-postgresql 0:5.9.2-3.amzn2.0.2
Amazon Linux · 2 qt5-qtbase-static 0:5.9.2-3.amzn2.0.2
Amazon Linux · 2 qt5-rpm-macros 0:5.9.2-3.amzn2.0.2

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-15518.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-19870.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-19873.html