Bugzilla – Bug 1176315
VUL-0: CVE-2020-17507: libqt4,libqt5-qtbase: buffer over-read in read_xbm_body in gui/image/qxbmhandler.cpp
Last modified: 2022-01-13 11:00:15 UTC
rh#1868532 An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buffer over-read. References: https://codereview.qt-project.org/c/qt/qtbase/+/308436 https://codereview.qt-project.org/c/qt/qtbase/+/308495 https://codereview.qt-project.org/c/qt/qtbase/+/308496 References: https://bugzilla.redhat.com/show_bug.cgi?id=1868532 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17507 http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-17507.html https://access.redhat.com/security/cve/CVE-2020-17507 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17507 https://codereview.qt-project.org/c/qt/qtbase/+/308495 https://codereview.qt-project.org/c/qt/qtbase/+/308496 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/426FCC6JNK4JUEX5QHJQDYQ6MUVQ3E6P/ https://codereview.qt-project.org/c/qt/qtbase/+/308436
tracking as affected: - SUSE:SLE-11-SP1:Update / libqt4 - SUSE:SLE-11-SP3:Update / libqt4 - SUSE:SLE-12:Update / libqt4 - SUSE:SLE-12-SP2:Update / libqt5-qtbase - SUSE:SLE-12-SP3:Update / libqt5-qtbase - SUSE:SLE-15:Update / libqt5-qtbase - SUSE:SLE-15-SP1:Update / libqt5-qtbase - SUSE:SLE-15-SP2:Update / libqt5-qtbase
(In reply to Robert Frohl from comment #1) > - SUSE:SLE-12-SP2:Update / libqt5-qtbase > - SUSE:SLE-12-SP3:Update / libqt5-qtbase > - SUSE:SLE-15:Update / libqt5-qtbase > - SUSE:SLE-15-SP1:Update / libqt5-qtbase > - SUSE:SLE-15-SP2:Update / libqt5-qtbase I ran osc mbranch and ended up with SLE 12 and SP1 as well. Do we care about those?
This is an autogenerated message for OBS integration: This bug (1176315) was mentioned in https://build.opensuse.org/request/show/834336 15.1 / libqt4
openSUSE-SU-2020:1452-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1118595,1118596,1118599,1121214,1176315 CVE References: CVE-2018-15518,CVE-2018-19869,CVE-2018-19873,CVE-2020-17507 JIRA References: Sources used: openSUSE Leap 15.1 (src): libqt4-4.8.7-lp151.9.3.1, libqt4-devel-doc-4.8.7-lp151.9.3.1, libqt4-sql-plugins-4.8.7-lp151.9.3.1
openSUSE-SU-2020:1500-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1118595,1118596,1118599,1121214,1176315 CVE References: CVE-2018-15518,CVE-2018-19869,CVE-2018-19873,CVE-2020-17507 JIRA References: Sources used: openSUSE Backports SLE-15-SP1 (src): libqt4-4.8.7-bp151.4.3.1, libqt4-devel-doc-4.8.7-bp151.4.3.1, libqt4-sql-plugins-4.8.7-bp151.4.3.1
openSUSE-SU-2020:1501-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1118595,1118596,1118599,1121214,1176315 CVE References: CVE-2018-15518,CVE-2018-19869,CVE-2018-19873,CVE-2020-17507 JIRA References: Sources used: openSUSE Leap 15.2 (src): libqt4-4.8.7-lp152.10.3.1, libqt4-devel-doc-4.8.7-lp152.10.3.1, libqt4-sql-plugins-4.8.7-lp152.10.3.1
SUSE-SU-2020:2741-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1172515,1176315 CVE References: CVE-2020-17507 JIRA References: Sources used: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 (src): libqt5-qtbase-5.9.7-13.8.1 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): libqt5-qtbase-5.9.7-13.8.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:2742-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1172515,1176315 CVE References: CVE-2020-17507 JIRA References: Sources used: SUSE Linux Enterprise Module for Desktop Applications 15-SP2 (src): libqt5-qtbase-5.12.7-4.6.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): libqt5-qtbase-5.12.7-4.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:2748-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1172515,1176315 CVE References: CVE-2020-17507 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): libqt5-qtbase-5.9.4-8.24.1 SUSE Linux Enterprise Server 15-LTSS (src): libqt5-qtbase-5.9.4-8.24.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): libqt5-qtbase-5.9.4-8.24.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): libqt5-qtbase-5.9.4-8.24.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:2751-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1172515,1176315 CVE References: CVE-2020-17507 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): libqt5-qtbase-5.6.2-6.25.1 SUSE OpenStack Cloud Crowbar 8 (src): libqt5-qtbase-5.6.2-6.25.1 SUSE OpenStack Cloud 9 (src): libqt5-qtbase-5.6.2-6.25.1 SUSE OpenStack Cloud 8 (src): libqt5-qtbase-5.6.2-6.25.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): libqt5-qtbase-5.6.2-6.25.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): libqt5-qtbase-5.6.2-6.25.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): libqt5-qtbase-5.6.2-6.25.1 SUSE Linux Enterprise Server 12-SP5 (src): libqt5-qtbase-5.6.2-6.25.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): libqt5-qtbase-5.6.2-6.25.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): libqt5-qtbase-5.6.2-6.25.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): libqt5-qtbase-5.6.2-6.25.1 SUSE Enterprise Storage 5 (src): libqt5-qtbase-5.6.2-6.25.1 HPE Helion Openstack 8 (src): libqt5-qtbase-5.6.2-6.25.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:1530-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1118595,1118596,1118599,1121214,1176315 CVE References: CVE-2018-15518,CVE-2018-19869,CVE-2018-19873,CVE-2020-17507 JIRA References: Sources used: openSUSE Backports SLE-15-SP2 (src): libqt4-4.8.7-bp152.4.3.1, libqt4-devel-doc-4.8.7-bp152.4.3.1, libqt4-sql-plugins-4.8.7-bp152.4.3.1
(In reply to Fabian Vogt from comment #3) > (In reply to Robert Frohl from comment #1) > > - SUSE:SLE-12-SP2:Update / libqt5-qtbase > > - SUSE:SLE-12-SP3:Update / libqt5-qtbase > > - SUSE:SLE-15:Update / libqt5-qtbase > > - SUSE:SLE-15-SP1:Update / libqt5-qtbase > > - SUSE:SLE-15-SP2:Update / libqt5-qtbase > > I ran osc mbranch and ended up with SLE 12 and SP1 as well. Do we care about > those? Sorry for the late reply, I missed this in all the mails. No, SLE12 and SLE12.1 are EOL.
SUSE-SU-2020:2760-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1172515,1176315 CVE References: CVE-2020-17507 JIRA References: Sources used: SUSE OpenStack Cloud 7 (src): libqt5-qtbase-5.6.1-17.16.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): libqt5-qtbase-5.6.1-17.16.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): libqt5-qtbase-5.6.1-17.16.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): libqt5-qtbase-5.6.1-17.16.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:1564-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1172515,1176315 CVE References: CVE-2020-17507 JIRA References: Sources used: openSUSE Leap 15.2 (src): libqt5-qtbase-5.12.7-lp152.3.6.1
openSUSE-SU-2020:1568-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1172515,1176315 CVE References: CVE-2020-17507 JIRA References: Sources used: openSUSE Leap 15.1 (src): libqt5-qtbase-5.9.7-lp151.4.6.1
openSUSE-SU-2020:2142-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1172515,1176315 CVE References: CVE-2020-17507 JIRA References: Sources used: openSUSE Leap 15.2 (src): libqt5-qtbase-5.12.7-lp152.3.9.1
SUSE-SU-2021:4155-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1176315,1184783 CVE References: CVE-2020-17507,CVE-2021-3481 JIRA References: Sources used: SUSE Linux Enterprise Workstation Extension 12-SP5 (src): libqt4-4.8.7-8.16.1, libqt4-sql-plugins-4.8.7-8.16.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): libqt4-4.8.7-8.16.1, libqt4-devel-doc-4.8.7-8.16.2, libqt4-sql-plugins-4.8.7-8.16.1 SUSE Linux Enterprise Server 12-SP5 (src): libqt4-4.8.7-8.16.1, libqt4-devel-doc-4.8.7-8.16.2, libqt4-sql-plugins-4.8.7-8.16.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
This is an autogenerated message for OBS integration: This bug (1176315) was mentioned in https://build.opensuse.org/request/show/946070 Factory / libqt5-qtbase