Bug 1176315 - (CVE-2020-17507) VUL-0: CVE-2020-17507: libqt4,libqt5-qtbase: buffer over-read in read_xbm_body in gui/image/qxbmhandler.cpp
(CVE-2020-17507)
VUL-0: CVE-2020-17507: libqt4,libqt5-qtbase: buffer over-read in read_xbm_bod...
Status: NEW
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Dirk Mueller
Security Team bot
https://smash.suse.de/issue/265153/
CVSSv3.1:SUSE:CVE-2020-17507:7.5:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2020-09-09 09:42 UTC by Robert Frohl
Modified: 2022-01-13 11:00 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Robert Frohl 2020-09-09 09:47:03 UTC
tracking as affected:
- SUSE:SLE-11-SP1:Update / libqt4
- SUSE:SLE-11-SP3:Update / libqt4
- SUSE:SLE-12:Update / libqt4

- SUSE:SLE-12-SP2:Update / libqt5-qtbase
- SUSE:SLE-12-SP3:Update / libqt5-qtbase
- SUSE:SLE-15:Update / libqt5-qtbase
- SUSE:SLE-15-SP1:Update / libqt5-qtbase
- SUSE:SLE-15-SP2:Update / libqt5-qtbase
Comment 3 Fabian Vogt 2020-09-11 12:18:28 UTC
(In reply to Robert Frohl from comment #1)
> - SUSE:SLE-12-SP2:Update / libqt5-qtbase
> - SUSE:SLE-12-SP3:Update / libqt5-qtbase
> - SUSE:SLE-15:Update / libqt5-qtbase
> - SUSE:SLE-15-SP1:Update / libqt5-qtbase
> - SUSE:SLE-15-SP2:Update / libqt5-qtbase

I ran osc mbranch and ended up with SLE 12 and SP1 as well. Do we care about those?
Comment 4 OBSbugzilla Bot 2020-09-14 17:10:26 UTC
This is an autogenerated message for OBS integration:
This bug (1176315) was mentioned in
https://build.opensuse.org/request/show/834336 15.1 / libqt4
Comment 6 Swamp Workflow Management 2020-09-18 22:16:51 UTC
openSUSE-SU-2020:1452-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1118595,1118596,1118599,1121214,1176315
CVE References: CVE-2018-15518,CVE-2018-19869,CVE-2018-19873,CVE-2020-17507
JIRA References: 
Sources used:
openSUSE Leap 15.1 (src):    libqt4-4.8.7-lp151.9.3.1, libqt4-devel-doc-4.8.7-lp151.9.3.1, libqt4-sql-plugins-4.8.7-lp151.9.3.1
Comment 7 Swamp Workflow Management 2020-09-22 13:14:56 UTC
openSUSE-SU-2020:1500-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1118595,1118596,1118599,1121214,1176315
CVE References: CVE-2018-15518,CVE-2018-19869,CVE-2018-19873,CVE-2020-17507
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP1 (src):    libqt4-4.8.7-bp151.4.3.1, libqt4-devel-doc-4.8.7-bp151.4.3.1, libqt4-sql-plugins-4.8.7-bp151.4.3.1
Comment 8 Swamp Workflow Management 2020-09-22 16:22:18 UTC
openSUSE-SU-2020:1501-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1118595,1118596,1118599,1121214,1176315
CVE References: CVE-2018-15518,CVE-2018-19869,CVE-2018-19873,CVE-2020-17507
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    libqt4-4.8.7-lp152.10.3.1, libqt4-devel-doc-4.8.7-lp152.10.3.1, libqt4-sql-plugins-4.8.7-lp152.10.3.1
Comment 9 Swamp Workflow Management 2020-09-24 19:13:55 UTC
SUSE-SU-2020:2741-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 1172515,1176315
CVE References: CVE-2020-17507
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Desktop Applications 15-SP1 (src):    libqt5-qtbase-5.9.7-13.8.1
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    libqt5-qtbase-5.9.7-13.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2020-09-24 19:14:52 UTC
SUSE-SU-2020:2742-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 1172515,1176315
CVE References: CVE-2020-17507
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Desktop Applications 15-SP2 (src):    libqt5-qtbase-5.12.7-4.6.1
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    libqt5-qtbase-5.12.7-4.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2020-09-25 13:26:43 UTC
SUSE-SU-2020:2748-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 1172515,1176315
CVE References: CVE-2020-17507
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    libqt5-qtbase-5.9.4-8.24.1
SUSE Linux Enterprise Server 15-LTSS (src):    libqt5-qtbase-5.9.4-8.24.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    libqt5-qtbase-5.9.4-8.24.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    libqt5-qtbase-5.9.4-8.24.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Swamp Workflow Management 2020-09-25 16:14:16 UTC
SUSE-SU-2020:2751-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 1172515,1176315
CVE References: CVE-2020-17507
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE OpenStack Cloud Crowbar 8 (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE OpenStack Cloud 9 (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE OpenStack Cloud 8 (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE Linux Enterprise Server 12-SP5 (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    libqt5-qtbase-5.6.2-6.25.1
SUSE Enterprise Storage 5 (src):    libqt5-qtbase-5.6.2-6.25.1
HPE Helion Openstack 8 (src):    libqt5-qtbase-5.6.2-6.25.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Swamp Workflow Management 2020-09-25 22:20:05 UTC
openSUSE-SU-2020:1530-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1118595,1118596,1118599,1121214,1176315
CVE References: CVE-2018-15518,CVE-2018-19869,CVE-2018-19873,CVE-2020-17507
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP2 (src):    libqt4-4.8.7-bp152.4.3.1, libqt4-devel-doc-4.8.7-bp152.4.3.1, libqt4-sql-plugins-4.8.7-bp152.4.3.1
Comment 14 Robert Frohl 2020-09-28 08:34:43 UTC
(In reply to Fabian Vogt from comment #3)
> (In reply to Robert Frohl from comment #1)
> > - SUSE:SLE-12-SP2:Update / libqt5-qtbase
> > - SUSE:SLE-12-SP3:Update / libqt5-qtbase
> > - SUSE:SLE-15:Update / libqt5-qtbase
> > - SUSE:SLE-15-SP1:Update / libqt5-qtbase
> > - SUSE:SLE-15-SP2:Update / libqt5-qtbase
> 
> I ran osc mbranch and ended up with SLE 12 and SP1 as well. Do we care about
> those?

Sorry for the late reply, I missed this in all the mails.

No, SLE12 and SLE12.1 are EOL.
Comment 15 Swamp Workflow Management 2020-09-28 13:21:41 UTC
SUSE-SU-2020:2760-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 1172515,1176315
CVE References: CVE-2020-17507
JIRA References: 
Sources used:
SUSE OpenStack Cloud 7 (src):    libqt5-qtbase-5.6.1-17.16.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    libqt5-qtbase-5.6.1-17.16.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    libqt5-qtbase-5.6.1-17.16.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    libqt5-qtbase-5.6.1-17.16.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 16 Swamp Workflow Management 2020-09-28 13:24:27 UTC
openSUSE-SU-2020:1564-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 1172515,1176315
CVE References: CVE-2020-17507
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    libqt5-qtbase-5.12.7-lp152.3.6.1
Comment 17 Swamp Workflow Management 2020-09-28 22:14:11 UTC
openSUSE-SU-2020:1568-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 1172515,1176315
CVE References: CVE-2020-17507
JIRA References: 
Sources used:
openSUSE Leap 15.1 (src):    libqt5-qtbase-5.9.7-lp151.4.6.1
Comment 20 Swamp Workflow Management 2020-12-01 20:16:16 UTC
openSUSE-SU-2020:2142-1: An update that solves one vulnerability and has one errata is now available.

Category: security (important)
Bug References: 1172515,1176315
CVE References: CVE-2020-17507
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    libqt5-qtbase-5.12.7-lp152.3.9.1
Comment 23 Swamp Workflow Management 2021-12-22 14:20:26 UTC
SUSE-SU-2021:4155-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1176315,1184783
CVE References: CVE-2020-17507,CVE-2021-3481
JIRA References: 
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP5 (src):    libqt4-4.8.7-8.16.1, libqt4-sql-plugins-4.8.7-8.16.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    libqt4-4.8.7-8.16.1, libqt4-devel-doc-4.8.7-8.16.2, libqt4-sql-plugins-4.8.7-8.16.1
SUSE Linux Enterprise Server 12-SP5 (src):    libqt4-4.8.7-8.16.1, libqt4-devel-doc-4.8.7-8.16.2, libqt4-sql-plugins-4.8.7-8.16.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 24 OBSbugzilla Bot 2022-01-13 11:00:15 UTC
This is an autogenerated message for OBS integration:
This bug (1176315) was mentioned in
https://build.opensuse.org/request/show/946070 Factory / libqt5-qtbase