ALSA-2020:1665 - Moderate: qt5 security, bug fix, and enhancement update
Summary
ALSA-2020:1665: Moderate: qt5 security, bug fix, and enhancement update. Affects python3-qt5-devel versions < 5.13.1-1.el8. Fixed in 5.13.1-1.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.
Vulnerability Detail
This vulnerability (CVE-2018-19872) in the qt package allows an attacker to cause a division by zero and crash in qppmhandler.cpp by providing a malformed PPM image. Another vulnerability (CVE-2018-19869) in qt5-qtsvg allows an attacker to cause a denial of service by exploiting invalid parsing of malformed URL references. Additionally, the qt5-qtimageformats package is vulnerable to a CPU exhaustion attack (CVE-2018-19871) due to improper handling of TGA files.
How To Fix
Minimum fixed version
5.13.1-1.el8
This is the first release that contains the fix.
sudo dnf update python3-qt5-develTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the qt package has been updated to address multiple vulnerabilities. It is recommended to upgrade the affected packages to the fixed versions to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python3-qt5-devel →
FAQ
Qt is a software toolkit for developing applications.
CVE-2018-19872 allows an attacker to cause a division by zero and crash in qppmhandler.cpp by providing a malformed PPM image.
CVE-2018-19869 allows an attacker to cause a denial of service by exploiting invalid parsing of malformed URL references.
CVE-2018-19871 allows an attacker to perform a CPU exhaustion attack by exploiting improper handling of TGA files.
To fix these vulnerabilities, you should upgrade the affected packages to the fixed versions.
