CVE-2018-19873
qt5-qtbase: QBmpHandler segmentation fault on malformed BMP file
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Amazon (moyenne), Oracle (moyenne), Ubuntu (moyenne), Red Hat (faible).
Description
An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 2 | qt, qt-assistant, qt-config et 24 autres | 1:4.8.5-15.amzn2.0.4 et 1 autres |
| debian 11 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 12 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 13 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 14 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 8 | qt4-x11, qtbase-opensource-src | 4:4.8.6+git64-g5dc8b2b+dfsg-3+deb8u2 et 1 autres |
| debian 9 | qt4-x11, qtbase-opensource-src | 4:4.8.7+dfsg-11+deb9u1 et 1 autres |
| echo | qtbase-opensource-src | 5.11.3+dfsg-2 |
| Oracle Linux 7 | qt, qt-assistant, qt-config et 112 autres | 1:4.8.7-8.el7 et 2 autres |
| Oracle Linux 8 | qt5-assistant, qt5-designer, qt5-doctools et 19 autres | 5.11.1-9.el8 et 1 autres |
| rapidfort fedora 43 | qt, qt-assistant, qt-common et 14 autres | 1:4.8.7-82.fc43 |
| ubuntu 16.04 | qtbase-opensource-src | 5.5.1+dfsg-16ubuntu7.6 |
Afficher les 196 entrées de 17 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 2 | qt | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-assistant | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-config | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-debuginfo | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-demos | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-devel | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-devel-private | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-doc | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-examples | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-mysql | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-odbc | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-postgresql | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-qdbusviewer | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-qvfb | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt-x11 | 1:4.8.5-15.amzn2.0.4 |
| amazon linux 2 | qt5-qtbase | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-common | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-debuginfo | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-devel | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-doc | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-examples | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-gui | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-mysql | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-odbc | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-postgresql | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-qtbase-static | 5.9.2-3.amzn2.0.2 |
| amazon linux 2 | qt5-rpm-macros | 5.9.2-3.amzn2.0.2 |
| debian 11 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 12 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 13 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 14 | qtbase-opensource-src | 5.11.3+dfsg-2 |
| debian 8 | qt4-x11 | 4:4.8.6+git64-g5dc8b2b+dfsg-3+deb8u2 |
| debian 8 | qtbase-opensource-src | 5.3.2+dfsg-4+deb8u3 |
| debian 9 | qt4-x11 | 4:4.8.7+dfsg-11+deb9u1 |
| debian 9 | qtbase-opensource-src | 5.7.1+dfsg-3+deb9u1 |
| echo | qtbase-opensource-src | 5.11.3+dfsg-2 |
| Oracle Linux 7 | qt | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-assistant | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-config | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-demos | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-devel | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-devel-private | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-doc | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-examples | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-mysql | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-odbc | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-postgresql | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-qdbusviewer | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-qvfb | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt-x11 | 1:4.8.7-8.el7 |
| Oracle Linux 7 | qt5-assistant | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-designer | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-doctools | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-linguist | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qdbusviewer | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qt3d | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qt3d-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qt3d-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qt3d-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtbase | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-common | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-devel | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-doc | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-examples | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-gui | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-mysql | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-odbc | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-postgresql | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtbase-static | 5.9.7-2.el7 |
| Oracle Linux 7 | qt5-qtcanvas3d | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtcanvas3d-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtcanvas3d-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtconnectivity | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtconnectivity-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtconnectivity-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtconnectivity-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdeclarative | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdeclarative-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdeclarative-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdeclarative-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdeclarative-static | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtdoc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtgraphicaleffects | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtgraphicaleffects-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtimageformats | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtimageformats-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtlocation | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtlocation-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtlocation-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtlocation-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtmultimedia | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtmultimedia-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtmultimedia-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtmultimedia-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols2 | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols2-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols2-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtquickcontrols2-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtscript | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtscript-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtscript-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtscript-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsensors | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsensors-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsensors-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsensors-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialbus | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialbus-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialbus-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialbus-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialport | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialport-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialport-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtserialport-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsvg | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsvg-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsvg-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtsvg-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-common | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-libs-designer | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-libs-designercomponents | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-libs-help | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttools-static | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qttranslations | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwayland | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwayland-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwayland-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwayland-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebchannel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebchannel-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebchannel-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebchannel-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebsockets | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebsockets-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebsockets-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtwebsockets-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtx11extras | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtx11extras-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtx11extras-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtxmlpatterns | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtxmlpatterns-devel | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtxmlpatterns-doc | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-qtxmlpatterns-examples | 5.9.7-1.el7 |
| Oracle Linux 7 | qt5-rpm-macros | 5.9.7-2.el7 |
| Oracle Linux 8 | qt5-assistant | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-designer | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-doctools | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-linguist | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qdbusviewer | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qtbase | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-common | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-devel | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-examples | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-gui | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-mysql | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-odbc | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-postgresql | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qtbase-static | 5.11.1-7.el8 |
| Oracle Linux 8 | qt5-qttools | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-common | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-devel | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-examples | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-libs-designer | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-libs-designercomponents | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-libs-help | 5.11.1-9.el8 |
| Oracle Linux 8 | qt5-qttools-static | 5.11.1-9.el8 |
| rapidfort fedora 43 | qt | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-assistant | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-common | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-config | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-demos | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-designer-plugin-webkit | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-devel | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-devel-private | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-doc | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-examples | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-mysql | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-odbc | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-postgresql | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-qdbusviewer | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-qvfb | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-tds | 1:4.8.7-82.fc43 |
| rapidfort fedora 43 | qt-x11 | 1:4.8.7-82.fc43 |
| ubuntu 16.04 | qtbase-opensource-src | 5.5.1+dfsg-16ubuntu7.6 |
| ubuntu 16.04-ESM | qtbase-opensource-src | 5.5.1+dfsg-16ubuntu7.6 |
| ubuntu 18.04 | qtbase-opensource-src | 5.9.5+dfsg-0ubuntu2.1 |
| ubuntu 18.04-ESM | qtbase-opensource-src | 5.9.5+dfsg-0ubuntu2.1 |
| ubuntu 18.10 | qtbase-opensource-src | 5.11.1+dfsg-7ubuntu3.1 |
| ubuntu 19.04 | qtbase-opensource-src | 5.11.3+dfsg-2ubuntu1 |
Références
- http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00066.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00057.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00071.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00073.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00090.html
- https://access.redhat.com/errata/RHSA-2019:2135
- https://access.redhat.com/errata/RHSA-2019:3390
- https://access.redhat.com/security/cve/CVE-2018-19873
Les 20 références
- https://blog.qt.io/blog/2018/12/04/qt-5-11-3-released-important-security-updates/
- https://codereview.qt-project.org/#/c/238749/
- https://linux.oracle.com/cve/CVE-2018-19873.html
- https://linux.oracle.com/errata/ELSA-2020-1172.html
- https://lists.debian.org/debian-lts-announce/2019/01/msg00004.html
- https://lists.debian.org/debian-lts-announce/2019/05/msg00014.html
- https://lists.debian.org/debian-lts-announce/2020/09/msg00023.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-19873
- https://ubuntu.com/security/notices/USN-4003-1
- https://usn.ubuntu.com/4003-1/
- https://www.cve.org/CVERecord?id=CVE-2018-19873
- https://www.debian.org/security/2019/dsa-4374