Bug 1130246 - (CVE-2018-19872) VUL-1: CVE-2018-19872: libqt5-qtbase: An issue was discovered in Qt 5.11. A malformed PPM image causes a division by zero and a crash in qppmhandler.cpp.
(CVE-2018-19872)
VUL-1: CVE-2018-19872: libqt5-qtbase: An issue was discovered in Qt 5.11. A m...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P4 - Low : Minor
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/226515/
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2019-03-22 16:33 UTC by Marcus Meissner
Modified: 2020-04-29 13:28 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2019-03-22 16:33:10 UTC
CVE-2018-19872

An issue was discovered in Qt 5.11. A malformed PPM image causes a division by
zero and a crash in qppmhandler.cpp.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-19872
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-19872.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19872
https://bugreports.qt.io/browse/QTBUG-69449
http://blog.qt.io/blog/2018/12/04/qt-5-11-3-released-important- security-updates/
Comment 3 Max Lin 2019-04-01 08:07:44 UTC
MR got accepted, re-assigning back.
Comment 4 Swamp Workflow Management 2019-04-10 19:09:48 UTC
SUSE-SU-2019:0927-1: An update that solves two vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 1108889,1118597,1129662,1130246
CVE References: CVE-2018-19870,CVE-2018-19872
Sources used:
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src):    libqt5-qtbase-5.9.4-8.18.2
SUSE Linux Enterprise Module for Desktop Applications 15 (src):    libqt5-qtbase-5.9.4-8.18.2
SUSE Linux Enterprise Module for Basesystem 15 (src):    libqt5-qtbase-5.9.4-8.18.2

*** NOTE: This information is not intended to be used for external
    communication, because this may only be a partial fix.
    If you have questions please reach out to maintenance coordination.
Comment 5 Swamp Workflow Management 2019-04-18 19:09:20 UTC
openSUSE-SU-2019:1239-1: An update that solves two vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 1108889,1118597,1129662,1130246
CVE References: CVE-2018-19870,CVE-2018-19872
Sources used:
openSUSE Leap 15.0 (src):    libqt5-qtbase-5.9.4-lp150.11.1
Comment 9 Swamp Workflow Management 2020-02-04 17:15:09 UTC
SUSE-SU-2020:0319-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1118597,1130246,1161167
CVE References: CVE-2018-19870,CVE-2018-19872,CVE-2020-0569
Sources used:
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    libqt5-qtbase-5.5.1-8.10.1
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    libqt5-qtbase-5.5.1-8.10.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2020-02-04 17:17:00 UTC
SUSE-SU-2020:0317-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1118597,1130246,1161167
CVE References: CVE-2018-19870,CVE-2018-19872,CVE-2020-0569
Sources used:
SUSE OpenStack Cloud 8 (src):    libqt5-qtbase-5.6.2-6.22.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    libqt5-qtbase-5.6.2-6.22.1
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    libqt5-qtbase-5.6.2-6.22.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    libqt5-qtbase-5.6.2-6.22.1
SUSE Linux Enterprise Server 12-SP5 (src):    libqt5-qtbase-5.6.2-6.22.1
SUSE Linux Enterprise Server 12-SP4 (src):    libqt5-qtbase-5.6.2-6.22.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    libqt5-qtbase-5.6.2-6.22.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    libqt5-qtbase-5.6.2-6.22.1
SUSE Linux Enterprise Desktop 12-SP4 (src):    libqt5-qtbase-5.6.2-6.22.1
SUSE Enterprise Storage 5 (src):    libqt5-qtbase-5.6.2-6.22.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2020-02-04 17:17:57 UTC
SUSE-SU-2020:0318-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1118597,1130246,1161167
CVE References: CVE-2018-19870,CVE-2018-19872,CVE-2020-0569
Sources used:
SUSE OpenStack Cloud 7 (src):    libqt5-qtbase-5.6.1-17.13.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    libqt5-qtbase-5.6.1-17.13.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    libqt5-qtbase-5.6.1-17.13.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    libqt5-qtbase-5.6.1-17.13.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Alexandros Toptsoglou 2020-04-29 13:28:38 UTC
Done