qt511: 5.11.1 -> 5.11.3, qt56 & qt59 security fixes #54986
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
CVE-2018-19865 tracks the issue of qtvirtualkeyboard where it logs all user input. With this commit we are applying the recommended patches form the upstream project. More details can be obtained from the Qt annoucement [1]. [1] https://blog.qt.io/blog/2018/12/04/qt-5-11-3-released-important-security-updates/
This adds the "missing" qtvirtualkeyboard module of qt56. I just add this so I can apply (& test) the patches for a CVE in the next commit. This might seem strange but in case anyone decided to add / use this in the future we are on the safe(r) side.
* CVE-2018-15518, Qt Base: “double free or corruption” in QXmlStreamReader * CVE-2018-19873, Qt Base: QBmpHandler segfault on malformed BMP file * CVE-2018-19870, Qt Base: Check for QImage allocation failure in qgifhandler * CVE-2018-19871, Qt Imageformats: QImage: QTgaFile CPU exhaustion * CVE-2018-19865, Qt Virtual Keyboard: Qt Virtual Keyboard logs all key presses * CVE-2018-19869, Qt Svg: Fix crash when parsing malformed url reference More details can be obtained from the Qt annoucement [1]. [1] https://blog.qt.io/blog/2018/12/04/qt-5-11-3-released-important-security-updates/
This fixes * CVE-2018-15518, Qt Base: “double free or corruption” in QXmlStreamReader * CVE-2018-19873, Qt Base: QBmpHandler segfault on malformed BMP file * CVE-2018-19870, Qt Base: Check for QImage allocation failure in qgifhandler * CVE-2018-19871, Qt Imageformats: QImage: QTgaFile CPU exhaustion * CVE-2018-19865, Qt Virtual Keyboard: Qt Virtual Keyboard logs all key presses * CVE-2018-19869, Qt Svg: Fix crash when parsing malformed url reference More details can be obtained from the Qt annoucement [1]. [1] https://blog.qt.io/blog/2018/12/04/qt-5-11-3-released-important-security-updates/
andir
added
1.severity: security
9.needs: port to stable
|
@andir probably also needs backporting. |
|
Yes, I have a WIP branch with back ports locally. Wanted to gather some
feedback from the Qt maintainers first :)
…On Thu, 31 Jan 2019, 11:33 Bastian Köcher, ***@***.***> wrote:
@andir <https://github.com/andir> probably also needs backporting.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#54986 (comment)>, or mute
the thread
<https://github.com/notifications/unsubscribe-auth/AAm_dJ0dYEwOfC6sn1BWHJLmLW0WbaHSks5vIsaEgaJpZM4ab_PP>
.
|
|
When rebuilding all the changes only the following two are failing:
Both of them seem to be failing for some time now. |
bkchr
approved these changes
Jan 31, 2019
10 tasks
3 tasks
veprbl
added
8.has: port to stable
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation for this change
I recently became aware of a few things in various Qt versions that we ship that we should address:
More details can be obtained from the Qt annoucement [1].
[1] https://blog.qt.io/blog/2018/12/04/qt-5-11-3-released-important-security-updates
cc maintainers @qknight @ttuegel @periklis @bkchr
Things done
sandboxinnix.confon non-NixOS)nix-shell -p nox --run "nox-review wip"./result/bin/)nix path-info -Sbefore and after)