Bug 1176315 – VUL-0: CVE-2020-17507: libqt4,libqt5-qtbase: buffer over-read in read_xbm_body in gui/image/qxbmhandler.cpp

Bug 1176315 - (CVE-2020-17507) VUL-0: CVE-2020-17507: libqt4,libqt5-qtbase: buffer over-read in read_xbm_body in gui/image/qxbmhandler.cpp

(CVE-2020-17507)
Summary:	VUL-0: CVE-2020-17507: libqt4,libqt5-qtbase: buffer over-read in read_xbm_bod...

Status:	NEW

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Major
Target Milestone:	---
Assigned To:	Dirk Mueller
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/265153/
Whiteboard:	CVSSv3.1:SUSE:CVE-2020-17507:7.5:(AV:...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2020-09-09 09:42 UTC by Robert Frohl
Modified:	2022-01-13 11:00 UTC (History)
CC List:	3 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Robert Frohl 2020-09-09 09:42:59 UTC

rh#1868532

An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buffer over-read.

References:
https://codereview.qt-project.org/c/qt/qtbase/+/308436
https://codereview.qt-project.org/c/qt/qtbase/+/308495
https://codereview.qt-project.org/c/qt/qtbase/+/308496

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1868532
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17507
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-17507.html
https://access.redhat.com/security/cve/CVE-2020-17507
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17507
https://codereview.qt-project.org/c/qt/qtbase/+/308495
https://codereview.qt-project.org/c/qt/qtbase/+/308496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/426FCC6JNK4JUEX5QHJQDYQ6MUVQ3E6P/
https://codereview.qt-project.org/c/qt/qtbase/+/308436

Comment 1 Robert Frohl 2020-09-09 09:47:03 UTC

tracking as affected:
- SUSE:SLE-11-SP1:Update / libqt4
- SUSE:SLE-11-SP3:Update / libqt4
- SUSE:SLE-12:Update / libqt4

- SUSE:SLE-12-SP2:Update / libqt5-qtbase
- SUSE:SLE-12-SP3:Update / libqt5-qtbase
- SUSE:SLE-15:Update / libqt5-qtbase
- SUSE:SLE-15-SP1:Update / libqt5-qtbase
- SUSE:SLE-15-SP2:Update / libqt5-qtbase

Comment 3 Fabian Vogt 2020-09-11 12:18:28 UTC

(In reply to Robert Frohl from comment #1)
> - SUSE:SLE-12-SP2:Update / libqt5-qtbase
> - SUSE:SLE-12-SP3:Update / libqt5-qtbase
> - SUSE:SLE-15:Update / libqt5-qtbase
> - SUSE:SLE-15-SP1:Update / libqt5-qtbase
> - SUSE:SLE-15-SP2:Update / libqt5-qtbase

I ran osc mbranch and ended up with SLE 12 and SP1 as well. Do we care about those?

Comment 4 OBSbugzilla Bot 2020-09-14 17:10:26 UTC

This is an autogenerated message for OBS integration:
This bug (1176315) was mentioned in
https://build.opensuse.org/request/show/834336 15.1 / libqt4

Comment 6 Swamp Workflow Management 2020-09-18 22:16:51 UTC

openSUSE-SU-2020:1452-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1118595,1118596,1118599,1121214,1176315
CVE References: CVE-2018-15518,CVE-2018-19869,CVE-2018-19873,CVE-2020-17507
JIRA References: 
Sources used:
openSUSE Leap 15.1 (src):    libqt4-4.8.7-lp151.9.3.1, libqt4-devel-doc-4.8.7-lp151.9.3.1, libqt4-sql-plugins-4.8.7-lp151.9.3.1

Comment 7 Swamp Workflow Management 2020-09-22 13:14:56 UTC

openSUSE-SU-2020:1500-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1118595,1118596,1118599,1121214,1176315
CVE References: CVE-2018-15518,CVE-2018-19869,CVE-2018-19873,CVE-2020-17507
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP1 (src):    libqt4-4.8.7-bp151.4.3.1, libqt4-devel-doc-4.8.7-bp151.4.3.1, libqt4-sql-plugins-4.8.7-bp151.4.3.1

Comment 8 Swamp Workflow Management 2020-09-22 16:22:18 UTC

openSUSE-SU-2020:1501-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1118595,1118596,1118599,1121214,1176315
CVE References: CVE-2018-15518,CVE-2018-19869,CVE-2018-19873,CVE-2020-17507
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    libqt4-4.8.7-lp152.10.3.1, libqt4-devel-doc-4.8.7-lp152.10.3.1, libqt4-sql-plugins-4.8.7-lp152.10.3.1

Comment 9 Swamp Workflow Management 2020-09-24 19:13:55 UTC

SUSE-SU-2020:2741-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 1172515,1176315
CVE References: CVE-2020-17507
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Desktop Applications 15-SP1 (src):    libqt5-qtbase-5.9.7-13.8.1
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    libqt5-qtbase-5.9.7-13.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 10 Swamp Workflow Management 2020-09-24 19:14:52 UTC

SUSE-SU-2020:2742-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 1172515,1176315
CVE References: CVE-2020-17507
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Desktop Applications 15-SP2 (src):    libqt5-qtbase-5.12.7-4.6.1
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    libqt5-qtbase-5.12.7-4.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 11 Swamp Workflow Management 2020-09-25 13:26:43 UTC

SUSE-SU-2020:2748-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 1172515,1176315
CVE References: CVE-2020-17507
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    libqt5-qtbase-5.9.4-8.24.1
SUSE Linux Enterprise Server 15-LTSS (src):    libqt5-qtbase-5.9.4-8.24.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    libqt5-qtbase-5.9.4-8.24.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    libqt5-qtbase-5.9.4-8.24.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 12 Swamp Workflow Management 2020-09-25 16:14:16 UTC

SUSE-SU-2020:2751-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 1172515,1176315
CVE References: CVE-2020-17507
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE OpenStack Cloud Crowbar 8 (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE OpenStack Cloud 9 (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE OpenStack Cloud 8 (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE Linux Enterprise Server 12-SP5 (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE Enterprise Storage 5 (src):    libqt5-qtbase-5.6.2-6.25.1
HPE Helion Openstack 8 (src):    libqt5-qtbase-5.6.2-6.25.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 13 Swamp Workflow Management 2020-09-25 22:20:05 UTC

openSUSE-SU-2020:1530-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1118595,1118596,1118599,1121214,1176315
CVE References: CVE-2018-15518,CVE-2018-19869,CVE-2018-19873,CVE-2020-17507
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP2 (src):    libqt4-4.8.7-bp152.4.3.1, libqt4-devel-doc-4.8.7-bp152.4.3.1, libqt4-sql-plugins-4.8.7-bp152.4.3.1

Comment 14 Robert Frohl 2020-09-28 08:34:43 UTC

(In reply to Fabian Vogt from comment #3)
> (In reply to Robert Frohl from comment #1)
> > - SUSE:SLE-12-SP2:Update / libqt5-qtbase
> > - SUSE:SLE-12-SP3:Update / libqt5-qtbase
> > - SUSE:SLE-15:Update / libqt5-qtbase
> > - SUSE:SLE-15-SP1:Update / libqt5-qtbase
> > - SUSE:SLE-15-SP2:Update / libqt5-qtbase
> 
> I ran osc mbranch and ended up with SLE 12 and SP1 as well. Do we care about
> those?

Sorry for the late reply, I missed this in all the mails.

No, SLE12 and SLE12.1 are EOL.

Comment 15 Swamp Workflow Management 2020-09-28 13:21:41 UTC

SUSE-SU-2020:2760-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 1172515,1176315
CVE References: CVE-2020-17507
JIRA References: 
Sources used:
SUSE OpenStack Cloud 7 (src):    libqt5-qtbase-5.6.1-17.16.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    libqt5-qtbase-5.6.1-17.16.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    libqt5-qtbase-5.6.1-17.16.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    libqt5-qtbase-5.6.1-17.16.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 16 Swamp Workflow Management 2020-09-28 13:24:27 UTC

openSUSE-SU-2020:1564-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 1172515,1176315
CVE References: CVE-2020-17507
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    libqt5-qtbase-5.12.7-lp152.3.6.1

Comment 17 Swamp Workflow Management 2020-09-28 22:14:11 UTC

openSUSE-SU-2020:1568-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 1172515,1176315
CVE References: CVE-2020-17507
JIRA References: 
Sources used:
openSUSE Leap 15.1 (src):    libqt5-qtbase-5.9.7-lp151.4.6.1

Comment 20 Swamp Workflow Management 2020-12-01 20:16:16 UTC

openSUSE-SU-2020:2142-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 1172515,1176315
CVE References: CVE-2020-17507
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    libqt5-qtbase-5.12.7-lp152.3.9.1

Comment 23 Swamp Workflow Management 2021-12-22 14:20:26 UTC

SUSE-SU-2021:4155-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1176315,1184783
CVE References: CVE-2020-17507,CVE-2021-3481
JIRA References: 
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP5 (src):    libqt4-4.8.7-8.16.1, libqt4-sql-plugins-4.8.7-8.16.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    libqt4-4.8.7-8.16.1, libqt4-devel-doc-4.8.7-8.16.2, libqt4-sql-plugins-4.8.7-8.16.1
SUSE Linux Enterprise Server 12-SP5 (src):    libqt4-4.8.7-8.16.1, libqt4-devel-doc-4.8.7-8.16.2, libqt4-sql-plugins-4.8.7-8.16.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 24 OBSbugzilla Bot 2022-01-13 11:00:15 UTC

This is an autogenerated message for OBS integration:
This bug (1176315) was mentioned in
https://build.opensuse.org/request/show/946070 Factory / libqt5-qtbase