Skip to content
OpenAdvisories
Medium ALAS2-2020-1458 6 CVEs

Moderate: qt security update (Amazon Linux 2)

Published Jul 14, 2020 · Updated Jul 17, 2020

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-19873: An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data. 1658998: CVE-2018-19873 qt5-qtbase: QBmpHandler segmentation fault on malformed BMP file CVE-2018-19872: An issue was discovered in Qt 5.11. A malformed PPM image causes a division by zero and a crash in qppmhandler.cpp. 1691636: CVE-2018-19872 qt: Malformed PPM image causing division by zero and crash in qppmhandler.cpp CVE-2018-19871: An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption. 1661465: CVE-2018-19871 qt5-qtimageformats: QTgaFile CPU exhaustion CVE-2018-19870: An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler resulting in a segmentation fault. 1658996: CVE-2018-19870 qt5-qtbase: QImage allocation failure in qgifhandler CVE-2018-19869: An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in qsvghandler.cpp. 1661460: CVE-2018-19869 qt5-qtsvg: Invalid parsing of malformed url reference resulting in a denial of service CVE-2018-15518: QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML document. 1659000: CVE-2018-15518 qt5-qtbase: Double free in QXmlStreamReader

Fixed packages 15

ReleasePackageFixed in
Amazon Linux · 2 qt 1:4.8.5-15.amzn2.0.4
Amazon Linux · 2 qt-assistant 1:4.8.5-15.amzn2.0.4
Amazon Linux · 2 qt-config 1:4.8.5-15.amzn2.0.4
Amazon Linux · 2 qt-debuginfo 1:4.8.5-15.amzn2.0.4
Amazon Linux · 2 qt-demos 1:4.8.5-15.amzn2.0.4
Amazon Linux · 2 qt-devel 1:4.8.5-15.amzn2.0.4
Amazon Linux · 2 qt-devel-private 1:4.8.5-15.amzn2.0.4
Amazon Linux · 2 qt-doc 1:4.8.5-15.amzn2.0.4
Amazon Linux · 2 qt-examples 1:4.8.5-15.amzn2.0.4
Amazon Linux · 2 qt-mysql 1:4.8.5-15.amzn2.0.4
Amazon Linux · 2 qt-odbc 1:4.8.5-15.amzn2.0.4
Amazon Linux · 2 qt-postgresql 1:4.8.5-15.amzn2.0.4
Amazon Linux · 2 qt-qdbusviewer 1:4.8.5-15.amzn2.0.4
Amazon Linux · 2 qt-qvfb 1:4.8.5-15.amzn2.0.4
Amazon Linux · 2 qt-x11 1:4.8.5-15.amzn2.0.4

Vulnerabilities 6

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-15518.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-19869.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-19870.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-19871.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-19872.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-19873.html