Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2021.2036 qt5-qtimageformats security update 9 June 2021 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: qt5-qtimageformats Publisher: Red Hat Operating System: Red Hat Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated Denial of Service -- Remote/Unauthenticated Access Confidential Data -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2020-36329 CVE-2020-36328 CVE-2018-25014 CVE-2018-25011 Reference: ESB-2021.1972 ESB-2021.1965 Original Bulletin: https://access.redhat.com/errata/RHSA-2021:2328 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: qt5-qtimageformats security update Advisory ID: RHSA-2021:2328-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:2328 Issue date: 2021-06-08 Cross references: 1961742 1961743 1961744 1961745 CVE Names: CVE-2018-25011 CVE-2018-25014 CVE-2020-36328 CVE-2020-36329 ===================================================================== 1. Summary: An update for qt5-qtimageformats is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - noarch Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch 3. Description: The Qt Image Formats in an add-on module for the core Qt Gui library that provides support for additional image formats including MNG, TGA, TIFF, WBMP, and WebP. Security Fix(es): * libwebp: heap-based buffer overflow in PutLE16() (CVE-2018-25011) * libwebp: use of uninitialized value in ReadSymbol() (CVE-2018-25014) * libwebp: heap-based buffer overflow in WebPDecode*Into functions (CVE-2020-36328) * libwebp: use-after-free in EmitFancyRGB() in dec/io_dec.c (CVE-2020-36329) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1956829 - CVE-2020-36328 libwebp: heap-based buffer overflow in WebPDecode*Into functions 1956843 - CVE-2020-36329 libwebp: use-after-free in EmitFancyRGB() in dec/io_dec.c 1956919 - CVE-2018-25011 libwebp: heap-based buffer overflow in PutLE16() 1956927 - CVE-2018-25014 libwebp: use of uninitialized value in ReadSymbol() 6. Package List: Red Hat Enterprise Linux Server (v. 7): Source: qt5-qtimageformats-5.9.7-2.el7_9.src.rpm ppc64: qt5-qtimageformats-5.9.7-2.el7_9.ppc.rpm qt5-qtimageformats-5.9.7-2.el7_9.ppc64.rpm qt5-qtimageformats-debuginfo-5.9.7-2.el7_9.ppc.rpm qt5-qtimageformats-debuginfo-5.9.7-2.el7_9.ppc64.rpm ppc64le: qt5-qtimageformats-5.9.7-2.el7_9.ppc64le.rpm qt5-qtimageformats-debuginfo-5.9.7-2.el7_9.ppc64le.rpm s390x: qt5-qtimageformats-5.9.7-2.el7_9.s390.rpm qt5-qtimageformats-5.9.7-2.el7_9.s390x.rpm qt5-qtimageformats-debuginfo-5.9.7-2.el7_9.s390.rpm qt5-qtimageformats-debuginfo-5.9.7-2.el7_9.s390x.rpm x86_64: qt5-qtimageformats-5.9.7-2.el7_9.i686.rpm qt5-qtimageformats-5.9.7-2.el7_9.x86_64.rpm qt5-qtimageformats-debuginfo-5.9.7-2.el7_9.i686.rpm qt5-qtimageformats-debuginfo-5.9.7-2.el7_9.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): noarch: qt5-qtimageformats-doc-5.9.7-2.el7_9.noarch.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: qt5-qtimageformats-5.9.7-2.el7_9.src.rpm x86_64: qt5-qtimageformats-5.9.7-2.el7_9.i686.rpm qt5-qtimageformats-5.9.7-2.el7_9.x86_64.rpm qt5-qtimageformats-debuginfo-5.9.7-2.el7_9.i686.rpm qt5-qtimageformats-debuginfo-5.9.7-2.el7_9.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): noarch: qt5-qtimageformats-doc-5.9.7-2.el7_9.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-25011 https://access.redhat.com/security/cve/CVE-2018-25014 https://access.redhat.com/security/cve/CVE-2020-36328 https://access.redhat.com/security/cve/CVE-2020-36329 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYL/yfNzjgjWX9erEAQiqXw/9HBTADT69X6MtPfJT3nEMponvcebRj7DY 6BpTyvPkqDlW/3t/cW3IZ4zw7CXxvpcUTX0KGc5cRSuGcyFr6gWModlpMhhLQsyH SLqyoR7wNr8pAFWNx4qQWSQbUtAQBiiSv2+4qlge/Sgg/JepzGF8458RcoVuWvRm 8lbwSwIgkck+0+6DW9zzRygkrTJSZXClZQevBRpdfyxMXFDpflfHTSoK/0HzcP+H gEPsnKwPmdRssROQUczbyjr3WwTQivMTrlh6ippGjbDwrg/dJ1z3LfgD/i+3/pM2 1t3B97bIqLoXkPqBEoxZ6Lenw+re9LffsnGcwF1xfn0NjuxS/lT8MXHQAvLt8/lh cBfCSgfwtv08hWK7Xme4kU/fG0e30ae+VqnI8cjAH1/yA4gNj2ZrVn8O/T9XKewJ NWSP97Yk9TdApHrWLbzcyXzXfx+KH473fbVvCXogSYKEu5yoMLK8yfNieU8Dc0qZ l0oVEiC9Z0BJI+xTGfEb1EfBiBmxqGUyk6Na3VaiOkhoJoI1MTcux5YYHA4GBmzl 9m6cqpNeZ+didTUNiXOgVo9ksAhpQk22AbZswNYVxy9pCiaRXt2Ah4I5OXijYiLu zkqrEU1ZwLr8EbBSRzFU2UBp+Wf/Vbp8t3pltYPJqc3vAFgvI2dA2luS0f+jIi4V xUr9Mv4P1kM= =o8wl - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYMBY/uNLKJtyKPYoAQjE/A//R759QaogU28Ap5hZykfR0F15XCQ0QVJh GDDh9r2VGP+w0A1JzelkpnvjRq1sHXJKcXY+VpTjNlRKEByb2cww6ltmtLZpgaNd PmU4odgX1BMuDB8+kzdbda4XuN+Zz/sEBNBoDqbVVKWoPfsFZZVbHQtfwF68atW5 0HTgiF1YRpxCnqNSM0SIysBs9VElnAY9eaIHszsf+ZksKSKMqB0uXdrxQZsNnjY5 kyZUMP++FwYBJD058fTu1xcT3yiEtjTXkWw6AvyrUspn4jZTSJXUPKM9tcdVpOpb RFxb5/l6iCHIwxYflzhQjq5lYl3hDvkALGbgaTMCBq+VsESVqPJWL3U2C6C7SbjE r0Xb09LzUz+ZjI2oub6PcTe+RPkQouuzS6mFPEaqG2n18UYwTRPOE0ix6i707iCV udyOyC1vlEf9OOvRkbQHmYT8NgiH3VHjdHWVhF2ZoHOgU3sCI1PjJ7duMRGv5QMm +b+mg86I0aV3gj3QTVrg6shmE1fTYEpfhXriN2rkfCuqNrsm88qkYsZl2Ro5lUuz LDUycB2Mr03ualW7HRxoEkAJqyZlndVgFGUpdFMtrY8Y04010ciSzeMuLg34H3Gt KWIxM2smyUiM6RrRMt5rQz5pDd1S6Ok1A2dD+zQXjcG8cWZl77Liu+8bim9DkeZS bWooZaWShP8= =Bwg5 -----END PGP SIGNATURE-----