CVE-2018-19873
qt5-qtbase: QBmpHandler segmentation fault on malformed BMP file
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Amazon (mittel), Oracle (mittel), Ubuntu (mittel), Red Hat (niedrig).
Beschreibung
An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 2 | qt, qt-assistant, qt-config und 24 weitere | 1:4.8.5-15.amzn2.0.4 und 1 weitere |
| debian 11 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 12 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 13 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 14 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 8 | qt4-x11, qtbase-opensource-src | 4:4.8.6+git64-g5dc8b2b+dfsg-3+deb8u2 und 1 weitere |
| debian 9 | qt4-x11, qtbase-opensource-src | 4:4.8.7+dfsg-11+deb9u1 und 1 weitere |
| echo | qtbase-opensource-src | 5.11.3+dfsg-2 |
| Oracle Linux 7 | qt, qt-assistant, qt-config und 112 weitere | 1:4.8.7-8.el7 und 2 weitere |
| Oracle Linux 8 | qt5-assistant, qt5-designer, qt5-doctools und 19 weitere | 5.11.1-9.el8 und 1 weitere |
| rapidfort fedora 43 | qt, qt-assistant, qt-common und 14 weitere | 1:4.8.7-82.fc43 |
| ubuntu 16.04 | qtbase-opensource-src | 5.5.1+dfsg-16ubuntu7.6 |
Alle 196 Einträge aus 17 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 2 | qt | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-assistant | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-config | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-debuginfo | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-demos | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-devel | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-devel-private | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-doc | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-examples | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-mysql | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-odbc | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-postgresql | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-qdbusviewer | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-qvfb | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-x11 | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt5-qtbase | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-common | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-debuginfo | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-devel | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-doc | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-examples | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-gui | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-mysql | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-odbc | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-postgresql | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-static | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-rpm-macros | 5.9.2-3.amzn2.0.2 |
| debian 11 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 12 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 13 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 14 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 8 | qt4-x11 | 4:4.8.6+git64-g5dc8b2b+dfsg-3+deb8u2 |
| debian 8 | qtbase-opensource-src | 5.3.2+dfsg-4+deb8u3 |
| debian 9 | qt4-x11 | 4:4.8.7+dfsg-11+deb9u1 |
| debian 9 | qtbase-opensource-src | 5.7.1+dfsg-3+deb9u1 |
| echo | qtbase-opensource-src | 5.11.3+dfsg-2 |
| Oracle Linux 7 | qt | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-assistant | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-config | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-demos | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-devel | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-devel-private | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-doc | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-examples | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-mysql | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-odbc | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-postgresql | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-qdbusviewer | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-qvfb | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-x11 | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt5-assistant | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-designer | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-doctools | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-linguist | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qdbusviewer | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qt3d | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qt3d-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qt3d-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qt3d-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtbase | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-common | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-devel | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-doc | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-examples | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-gui | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-mysql | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-odbc | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-postgresql | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-static | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtcanvas3d | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtcanvas3d-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtcanvas3d-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtconnectivity | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtconnectivity-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtconnectivity-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtconnectivity-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdeclarative | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdeclarative-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdeclarative-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdeclarative-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdeclarative-static | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdoc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtgraphicaleffects | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtgraphicaleffects-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtimageformats | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtimageformats-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtlocation | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtlocation-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtlocation-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtlocation-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtmultimedia | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtmultimedia-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtmultimedia-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtmultimedia-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols2 | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols2-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols2-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols2-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtscript | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtscript-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtscript-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtscript-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsensors | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsensors-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsensors-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsensors-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialbus | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialbus-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialbus-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialbus-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialport | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialport-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialport-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialport-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsvg | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsvg-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsvg-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsvg-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-common | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-libs-designer | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-libs-designercomponents | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-libs-help | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-static | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttranslations | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwayland | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwayland-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwayland-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwayland-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebchannel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebchannel-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebchannel-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebchannel-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebsockets | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebsockets-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebsockets-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebsockets-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtx11extras | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtx11extras-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtx11extras-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtxmlpatterns | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtxmlpatterns-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtxmlpatterns-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtxmlpatterns-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-rpm-macros | 5.9.7-2.el7 |
| Oracle Linux 8 | qt5-assistant | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-designer | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-doctools | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-linguist | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qdbusviewer | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qtbase | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-common | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-devel | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-examples | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-gui | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-mysql | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-odbc | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-postgresql | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-static | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qttools | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-common | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-devel | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-examples | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-libs-designer | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-libs-designercomponents | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-libs-help | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-static | 5.11.1-9.el8 |
| rapidfort fedora 43 | qt | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-assistant | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-common | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-config | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-demos | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-designer-plugin-webkit | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-devel | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-devel-private | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-doc | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-examples | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-mysql | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-odbc | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-postgresql | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-qdbusviewer | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-qvfb | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-tds | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-x11 | 1:4.8.7-82.fc43 |
| ubuntu 16.04 | qtbase-opensource-src | 5.5.1+dfsg-16ubuntu7.6 |
| ubuntu 16.04-ESM | qtbase-opensource-src | 5.5.1+dfsg-16ubuntu7.6 |
| ubuntu 18.04 | qtbase-opensource-src | 5.9.5+dfsg-0ubuntu2.1 |
| ubuntu 18.04-ESM | qtbase-opensource-src | 5.9.5+dfsg-0ubuntu2.1 |
| ubuntu 18.10 | qtbase-opensource-src | 5.11.1+dfsg-7ubuntu3.1 |
| ubuntu 19.04 | qtbase-opensource-src | 5.11.3+dfsg-2ubuntu1 |
Referenzen
- http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00066.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00057.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00071.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00073.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00090.html
- https://access.redhat.com/errata/RHSA-2019:2135
- https://access.redhat.com/errata/RHSA-2019:3390
- https://access.redhat.com/security/cve/CVE-2018-19873
Alle 20 Referenzen
- https://blog.qt.io/blog/2018/12/04/qt-5-11-3-released-important-security-updates/
- https://codereview.qt-project.org/#/c/238749/
- https://linux.oracle.com/cve/CVE-2018-19873.html
- https://linux.oracle.com/errata/ELSA-2020-1172.html
- https://lists.debian.org/debian-lts-announce/2019/01/msg00004.html
- https://lists.debian.org/debian-lts-announce/2019/05/msg00014.html
- https://lists.debian.org/debian-lts-announce/2020/09/msg00023.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-19873
- https://ubuntu.com/security/notices/USN-4003-1
- https://usn.ubuntu.com/4003-1/
- https://www.cve.org/CVERecord?id=CVE-2018-19873
- https://www.debian.org/security/2019/dsa-4374