Debian Bug report logs - #267092
qt-x11-free: [CAN-2004-0691][CAN-2004-0692][CAN-2004-0693] Qt Image Handling Buffer Overflow Vulnerability

Package: qt-x11-free; Maintainer for qt-x11-free is Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>;

Reported by: Adam Majer <adamm@galacticasoftware.com>

Date: Fri, 20 Aug 2004 17:48:01 UTC

Severity: grave

Tags: patch, sarge, security

Done: Steve Langasek <vorlon@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Martin Loschwitz <madkiss@debian.org>:
Bug#267092; Package qt-x11-free. Full text and rfc822 format available.

Acknowledgement sent to Adam Majer <adamm@galacticasoftware.com>:
New Bug report received and forwarded. Copy sent to Martin Loschwitz <madkiss@debian.org>. Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Adam Majer <adamm@galacticasoftware.com>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: qt-x11-free: [CAN-2004-0691][CAN-2004-0692][CAN-2004-0693] Qt Image Handling Buffer Overflow Vulnerability
Date: Fri, 20 Aug 2004 12:32:22 -0500
Package: qt-x11-free
Severity: grave
Tags: security sarge
Justification: user security hole

CVE reference:	CAN-2004-0691
		CAN-2004-0692
		CAN-2004-0693

Description:
Chris Evans has reported a vulnerability in the Qt library, which
potentially can be exploited by malicious people to compromise a user's
system.

The vulnerability is caused due to boundary errors in the "read_dib()"
function when handling 8-bit RLE encoded BMP files. This can be
exploited by using an overly long length mark in order to cause a
heap-based buffer overflow.

Successful exploitation may allow execution of arbitrary code and can be
exploited via any application using the Qt library to display or decode
BMP files.

NOTE: Some NULL pointer dereference errors within the handlers for XPM,
GIF, and JPEG images can also be exploited to cause a DoS (Denial of
Service).

The vulnerability affects version 3.3.2 and prior.

Solution:
Update to version 3.3.3.

Original Advisory:
http://secunia.com/advisories/12325/

Other:
http://scary.beasts.org/security/CESA-2004-004.txt


This probably also affects Woody.

- Adam


-- System Information:
Debian Release: 3.1
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.7-1-k7
Locale: LANG=C, LC_CTYPE=C



Information forwarded to debian-bugs-dist@lists.debian.org, Martin Loschwitz <madkiss@debian.org>:
Bug#267092; Package qt-x11-free. Full text and rfc822 format available.

Acknowledgement sent to Martin Pitt <martin@piware.de>:
Extra info received and forwarded to list. Copy sent to Martin Loschwitz <madkiss@debian.org>. Full text and rfc822 format available.

Message #10 received at 267092@bugs.debian.org (full text, mbox):

From: Martin Pitt <martin@piware.de>
To: 267092@bugs.debian.org
Subject: Patch for the Sarge version
Date: Thu, 9 Sep 2004 19:39:48 +0200
[Message part 1 (text/plain, inline)]
Hi!

I prepared a dpatch for Sarge's version 3.2.3 which fixes the bounds
checking. The patch is at 

http://fix.that.hole.no-name-yet.com/patches/qt-x11-free.267092.dpatch

Please rename it to 14_read_dib_boundscheck.dpatch, put it into
debian/patches, add it to the patch list and maybe upload to
testing-proposed-updates.

Thanks for considering,

Martin

-- 
Martin Pitt                 Debian GNU/Linux Developer
martin@piware.de                      mpitt@debian.org
http://www.piware.de             http://www.debian.org
[signature.asc (application/pgp-signature, inline)]

Tags added: patch Request was from Martin Pitt <mpitt@debian.org> to control@bugs.debian.org. Full text and rfc822 format available.

Reply sent to Steve Langasek <vorlon@debian.org>:
You have taken responsibility. Full text and rfc822 format available.

Notification sent to Adam Majer <adamm@galacticasoftware.com>:
Bug acknowledged by developer. Full text and rfc822 format available.

Message #17 received at 267092-done@bugs.debian.org (full text, mbox):

From: Steve Langasek <vorlon@debian.org>
To: 267092-done@bugs.debian.org
Subject: Re: qt-x11-free: [CAN-2004-0691][CAN-2004-0692][CAN-2004-0693] Qt Image Handling Buffer Overflow Vulnerability
Date: Tue, 21 Sep 2004 16:42:17 -0700
[Message part 1 (text/plain, inline)]
Version 3.3.3 of qt-x11-free, which fixes this bug, has reached sarge; I
am therefore closing this bug report.

-- 
Steve Langasek
postmodern programmer
[signature.asc (application/pgp-signature, inline)]

Bug unarchived. Request was from Stefano Zacchiroli <zack@debian.org> to control@bugs.debian.org. (Sun, 10 Apr 2011 08:43:45 GMT) Full text and rfc822 format available.

Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Mon, 09 May 2011 07:50:52 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sun Apr 20 09:42:02 2014; Machine Name: buxtehude.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.