Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-19873: An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data. 1658998: CVE-2018-19873 qt5-qtbase: QBmpHandler segmentation fault on malformed BMP file CVE-2018-19872: An issue was discovered in Qt 5.11. A malformed PPM image causes a division by zero and a crash in qppmhandler.cpp. 1691636: CVE-2018-19872 qt: Malformed PPM image causing division by zero and crash in qppmhandler.cpp CVE-2018-19871: An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption. 1661465: CVE-2018-19871 qt5-qtimageformats: QTgaFile CPU exhaustion CVE-2018-19870: An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler resulting in a segmentation fault. 1658996: CVE-2018-19870 qt5-qtbase: QImage allocation failure in qgifhandler CVE-2018-19869: An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in qsvghandler.cpp. 1661460: CVE-2018-19869 qt5-qtsvg: Invalid parsing of malformed url reference resulting in a denial of service CVE-2018-15518: QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML document. 1659000: CVE-2018-15518 qt5-qtbase: Double free in QXmlStreamReader
Fixed packages 15
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | qt | 1:4.8.5-15.amzn2.0.4 |
| Amazon Linux · 2 | qt-assistant | 1:4.8.5-15.amzn2.0.4 |
| Amazon Linux · 2 | qt-config | 1:4.8.5-15.amzn2.0.4 |
| Amazon Linux · 2 | qt-debuginfo | 1:4.8.5-15.amzn2.0.4 |
| Amazon Linux · 2 | qt-demos | 1:4.8.5-15.amzn2.0.4 |
| Amazon Linux · 2 | qt-devel | 1:4.8.5-15.amzn2.0.4 |
| Amazon Linux · 2 | qt-devel-private | 1:4.8.5-15.amzn2.0.4 |
| Amazon Linux · 2 | qt-doc | 1:4.8.5-15.amzn2.0.4 |
| Amazon Linux · 2 | qt-examples | 1:4.8.5-15.amzn2.0.4 |
| Amazon Linux · 2 | qt-mysql | 1:4.8.5-15.amzn2.0.4 |
| Amazon Linux · 2 | qt-odbc | 1:4.8.5-15.amzn2.0.4 |
| Amazon Linux · 2 | qt-postgresql | 1:4.8.5-15.amzn2.0.4 |
| Amazon Linux · 2 | qt-qdbusviewer | 1:4.8.5-15.amzn2.0.4 |
| Amazon Linux · 2 | qt-qvfb | 1:4.8.5-15.amzn2.0.4 |
| Amazon Linux · 2 | qt-x11 | 1:4.8.5-15.amzn2.0.4 |
Vulnerabilities 6
-
Unscored —
QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted illegal XML do…
-
Unscored —
An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in qsvghandler.cpp.
-
Unscored —
An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler res…
-
Unscored —
An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption.
-
Unscored —
An issue was discovered in Qt 5.11. A malformed PPM image causes a division by zero and a crash in qppmhandler.cpp.
-
Unscored —
An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-15518.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-19869.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-19870.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-19871.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-19872.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-19873.html