CVE-2018-19873
qt5-qtbase: QBmpHandler segmentation fault on malformed BMP file
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Amazon (media), Oracle (media), Ubuntu (media), Red Hat (baja).
Descripción
An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| amazon linux 2 | qt, qt-assistant, qt-config y 24 más | 1:4.8.5-15.amzn2.0.4 y 1 más |
| debian 11 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 12 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 13 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 14 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 8 | qt4-x11, qtbase-opensource-src | 4:4.8.6+git64-g5dc8b2b+dfsg-3+deb8u2 y 1 más |
| debian 9 | qt4-x11, qtbase-opensource-src | 4:4.8.7+dfsg-11+deb9u1 y 1 más |
| echo | qtbase-opensource-src | 5.11.3+dfsg-2 |
| Oracle Linux 7 | qt, qt-assistant, qt-config y 112 más | 1:4.8.7-8.el7 y 2 más |
| Oracle Linux 8 | qt5-assistant, qt5-designer, qt5-doctools y 19 más | 5.11.1-9.el8 y 1 más |
| rapidfort fedora 43 | qt, qt-assistant, qt-common y 14 más | 1:4.8.7-82.fc43 |
| ubuntu 16.04 | qtbase-opensource-src | 5.5.1+dfsg-16ubuntu7.6 |
Mostrar las 196 entradas de 17 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| amazon linux 2 | qt | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-assistant | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-config | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-debuginfo | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-demos | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-devel | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-devel-private | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-doc | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-examples | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-mysql | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-odbc | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-postgresql | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-qdbusviewer | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-qvfb | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-x11 | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt5-qtbase | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-common | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-debuginfo | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-devel | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-doc | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-examples | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-gui | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-mysql | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-odbc | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-postgresql | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-static | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-rpm-macros | 5.9.2-3.amzn2.0.2 |
| debian 11 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 12 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 13 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 14 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 8 | qt4-x11 | 4:4.8.6+git64-g5dc8b2b+dfsg-3+deb8u2 |
| debian 8 | qtbase-opensource-src | 5.3.2+dfsg-4+deb8u3 |
| debian 9 | qt4-x11 | 4:4.8.7+dfsg-11+deb9u1 |
| debian 9 | qtbase-opensource-src | 5.7.1+dfsg-3+deb9u1 |
| echo | qtbase-opensource-src | 5.11.3+dfsg-2 |
| Oracle Linux 7 | qt | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-assistant | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-config | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-demos | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-devel | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-devel-private | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-doc | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-examples | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-mysql | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-odbc | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-postgresql | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-qdbusviewer | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-qvfb | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-x11 | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt5-assistant | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-designer | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-doctools | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-linguist | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qdbusviewer | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qt3d | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qt3d-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qt3d-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qt3d-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtbase | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-common | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-devel | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-doc | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-examples | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-gui | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-mysql | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-odbc | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-postgresql | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-static | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtcanvas3d | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtcanvas3d-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtcanvas3d-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtconnectivity | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtconnectivity-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtconnectivity-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtconnectivity-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdeclarative | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdeclarative-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdeclarative-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdeclarative-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdeclarative-static | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdoc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtgraphicaleffects | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtgraphicaleffects-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtimageformats | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtimageformats-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtlocation | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtlocation-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtlocation-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtlocation-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtmultimedia | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtmultimedia-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtmultimedia-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtmultimedia-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols2 | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols2-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols2-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols2-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtscript | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtscript-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtscript-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtscript-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsensors | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsensors-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsensors-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsensors-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialbus | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialbus-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialbus-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialbus-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialport | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialport-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialport-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialport-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsvg | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsvg-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsvg-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsvg-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-common | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-libs-designer | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-libs-designercomponents | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-libs-help | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-static | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttranslations | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwayland | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwayland-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwayland-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwayland-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebchannel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebchannel-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebchannel-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebchannel-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebsockets | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebsockets-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebsockets-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebsockets-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtx11extras | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtx11extras-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtx11extras-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtxmlpatterns | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtxmlpatterns-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtxmlpatterns-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtxmlpatterns-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-rpm-macros | 5.9.7-2.el7 |
| Oracle Linux 8 | qt5-assistant | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-designer | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-doctools | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-linguist | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qdbusviewer | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qtbase | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-common | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-devel | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-examples | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-gui | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-mysql | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-odbc | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-postgresql | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-static | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qttools | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-common | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-devel | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-examples | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-libs-designer | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-libs-designercomponents | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-libs-help | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-static | 5.11.1-9.el8 |
| rapidfort fedora 43 | qt | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-assistant | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-common | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-config | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-demos | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-designer-plugin-webkit | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-devel | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-devel-private | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-doc | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-examples | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-mysql | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-odbc | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-postgresql | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-qdbusviewer | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-qvfb | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-tds | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-x11 | 1:4.8.7-82.fc43 |
| ubuntu 16.04 | qtbase-opensource-src | 5.5.1+dfsg-16ubuntu7.6 |
| ubuntu 16.04-ESM | qtbase-opensource-src | 5.5.1+dfsg-16ubuntu7.6 |
| ubuntu 18.04 | qtbase-opensource-src | 5.9.5+dfsg-0ubuntu2.1 |
| ubuntu 18.04-ESM | qtbase-opensource-src | 5.9.5+dfsg-0ubuntu2.1 |
| ubuntu 18.10 | qtbase-opensource-src | 5.11.1+dfsg-7ubuntu3.1 |
| ubuntu 19.04 | qtbase-opensource-src | 5.11.3+dfsg-2ubuntu1 |
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00066.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00057.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00071.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00073.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00090.html
- https://access.redhat.com/errata/RHSA-2019:2135
- https://access.redhat.com/errata/RHSA-2019:3390
- https://access.redhat.com/security/cve/CVE-2018-19873
Las 20 referencias
- https://blog.qt.io/blog/2018/12/04/qt-5-11-3-released-important-security-updates/
- https://codereview.qt-project.org/#/c/238749/
- https://linux.oracle.com/cve/CVE-2018-19873.html
- https://linux.oracle.com/errata/ELSA-2020-1172.html
- https://lists.debian.org/debian-lts-announce/2019/01/msg00004.html
- https://lists.debian.org/debian-lts-announce/2019/05/msg00014.html
- https://lists.debian.org/debian-lts-announce/2020/09/msg00023.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-19873
- https://ubuntu.com/security/notices/USN-4003-1
- https://usn.ubuntu.com/4003-1/
- https://www.cve.org/CVERecord?id=CVE-2018-19873
- https://www.debian.org/security/2019/dsa-4374