Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Qt5 libraries may crash or hang from malformed files
published 6 years ago
Summary
The Qt5 development packages for AlmaLinux (including qt5-base, qt5-qtdeclarative, qt5-qtsvg, and related libraries) have been updated to address several issues where specially crafted image or URL data could cause a program to crash, become unresponsive, or consume excessive CPU. These problems could let an attacker make your application stop working or slow down. Apply the latest package versions (5.12.5 or newer) to protect your software.
What to do
- Update almalinux python3-qt5-devel to version 5.13.1-1.el8.
- Update almalinux qt5-devel to version 5.12.5-3.el8.
- Update almalinux qt5-qtdeclarative-static to version 5.12.5-1.el8.
- Update almalinux qt5-qtdoc to version 5.12.5-1.el8.
- Update almalinux qt5-qtquickcontrols2-devel to version 5.12.5-1.el8.
- Update almalinux qt5-qttranslations to version 5.12.5-1.el8.
- Update almalinux qt5-qtwayland-devel to version 5.12.5-1.el8.
- Update almalinux qt5-rpm-macros to version 5.12.5-3.el8.
- Update almalinux qt5-srpm-macros to version 5.12.5-3.el8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | python3-qt5-devel |
< 5.13.1-1.el8 Fix: upgrade to 5.13.1-1.el8
|
| AlmaLinux:8 | almalinux | qt5-devel |
< 5.12.5-3.el8 Fix: upgrade to 5.12.5-3.el8
|
| AlmaLinux:8 | almalinux | qt5-qtdeclarative-static |
< 5.12.5-1.el8 Fix: upgrade to 5.12.5-1.el8
|
| AlmaLinux:8 | almalinux | qt5-qtdoc |
< 5.12.5-1.el8 Fix: upgrade to 5.12.5-1.el8
|
| AlmaLinux:8 | almalinux | qt5-qtquickcontrols2-devel |
< 5.12.5-1.el8 Fix: upgrade to 5.12.5-1.el8
|
| AlmaLinux:8 | almalinux | qt5-qttranslations |
< 5.12.5-1.el8 Fix: upgrade to 5.12.5-1.el8
|
| AlmaLinux:8 | almalinux | qt5-qtwayland-devel |
< 5.12.5-1.el8 Fix: upgrade to 5.12.5-1.el8
|
| AlmaLinux:8 | almalinux | qt5-rpm-macros |
< 5.12.5-3.el8 Fix: upgrade to 5.12.5-3.el8
|
| AlmaLinux:8 | almalinux | qt5-srpm-macros |
< 5.12.5-3.el8 Fix: upgrade to 5.12.5-3.el8
|
Original advisory text
Moderate: qt5 security, bug fix, and enhancement update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.
The following packages have been upgraded to a later upstream version: qt5 (5.12.5), qt5-qt3d (5.12.5), qt5-qtbase (5.12.5), qt5-qtcanvas3d (5.12.5), qt5-qtconnectivity (5.12.5), qt5-qtdeclarative (5.12.5), qt5-qtdoc (5.12.5), qt5-qtgraphicaleffects (5.12.5), qt5-qtimageformats (5.12.5), qt5-qtlocation (5.12.5), qt5-qtmultimedia (5.12.5), qt5-qtquickcontrols (5.12.5), qt5-qtquickcontrols2 (5.12.5), qt5-qtscript (5.12.5), qt5-qtsensors (5.12.5), qt5-qtserialbus (5.12.5), qt5-qtserialport (5.12.5), qt5-qtsvg (5.12.5), qt5-qttools (5.12.5), qt5-qttranslations (5.12.5), qt5-qtwayland (5.12.5), qt5-qtwebchannel (5.12.5), qt5-qtwebsockets (5.12.5), qt5-qtx11extras (5.12.5), qt5-qtxmlpatterns (5.12.5), python-qt5 (5.13.1), sip (4.19.19). (BZ#1775603, BZ#1775604)
Security Fix(es):
* qt: Malformed PPM image causing division by zero and crash in qppmhandler.cpp (CVE-2018-19872)
* qt5-qtsvg: Invalid parsing of malformed url reference resulting in a denial of service (CVE-2018-19869)
* qt5-qtimageformats: QTgaFile CPU exhaustion (CVE-2018-19871)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
The following packages have been upgraded to a later upstream version: qt5 (5.12.5), qt5-qt3d (5.12.5), qt5-qtbase (5.12.5), qt5-qtcanvas3d (5.12.5), qt5-qtconnectivity (5.12.5), qt5-qtdeclarative (5.12.5), qt5-qtdoc (5.12.5), qt5-qtgraphicaleffects (5.12.5), qt5-qtimageformats (5.12.5), qt5-qtlocation (5.12.5), qt5-qtmultimedia (5.12.5), qt5-qtquickcontrols (5.12.5), qt5-qtquickcontrols2 (5.12.5), qt5-qtscript (5.12.5), qt5-qtsensors (5.12.5), qt5-qtserialbus (5.12.5), qt5-qtserialport (5.12.5), qt5-qtsvg (5.12.5), qt5-qttools (5.12.5), qt5-qttranslations (5.12.5), qt5-qtwayland (5.12.5), qt5-qtwebchannel (5.12.5), qt5-qtwebsockets (5.12.5), qt5-qtx11extras (5.12.5), qt5-qtxmlpatterns (5.12.5), python-qt5 (5.13.1), sip (4.19.19). (BZ#1775603, BZ#1775604)
Security Fix(es):
* qt: Malformed PPM image causing division by zero and crash in qppmhandler.cpp (CVE-2018-19872)
* qt5-qtsvg: Invalid parsing of malformed url reference resulting in a denial of service (CVE-2018-19869)
* qt5-qtimageformats: QTgaFile CPU exhaustion (CVE-2018-19871)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
References
- https://vulners.com/cve/CVE-2018-19869 Third Party Advisory
- https://vulners.com/cve/CVE-2018-19871 Third Party Advisory
- https://vulners.com/cve/CVE-2018-19872 Third Party Advisory
Timeline
Published28 Apr 2020
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2020:1665 · OSV
Track software like this
Free during beta