Debian Bug report logs - #267092
qt-x11-free: [CAN-2004-0691][CAN-2004-0692][CAN-2004-0693] Qt Image Handling Buffer Overflow Vulnerability

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Adam Majer <adamm@galacticasoftware.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: qt-x11-free: [CAN-2004-0691][CAN-2004-0692][CAN-2004-0693] Qt Image Handling Buffer Overflow Vulnerability

Date: Fri, 20 Aug 2004 12:32:22 -0500

Package: qt-x11-free
Severity: grave
Tags: security sarge
Justification: user security hole

CVE reference:	CAN-2004-0691
		CAN-2004-0692
		CAN-2004-0693

Description:
Chris Evans has reported a vulnerability in the Qt library, which
potentially can be exploited by malicious people to compromise a user's
system.

The vulnerability is caused due to boundary errors in the "read_dib()"
function when handling 8-bit RLE encoded BMP files. This can be
exploited by using an overly long length mark in order to cause a
heap-based buffer overflow.

Successful exploitation may allow execution of arbitrary code and can be
exploited via any application using the Qt library to display or decode
BMP files.

NOTE: Some NULL pointer dereference errors within the handlers for XPM,
GIF, and JPEG images can also be exploited to cause a DoS (Denial of
Service).

The vulnerability affects version 3.3.2 and prior.

Solution:
Update to version 3.3.3.

Original Advisory:
http://secunia.com/advisories/12325/

Other:
http://scary.beasts.org/security/CESA-2004-004.txt


This probably also affects Woody.

- Adam


-- System Information:
Debian Release: 3.1
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.7-1-k7
Locale: LANG=C, LC_CTYPE=C

Message #10 received at 267092@bugs.debian.org (full text, mbox, reply):

From: Martin Pitt <martin@piware.de>

To: 267092@bugs.debian.org

Subject: Patch for the Sarge version

Date: Thu, 9 Sep 2004 19:39:48 +0200

[Message part 1 (text/plain, inline)]

Hi!

I prepared a dpatch for Sarge's version 3.2.3 which fixes the bounds
checking. The patch is at 

http://fix.that.hole.no-name-yet.com/patches/qt-x11-free.267092.dpatch

Please rename it to 14_read_dib_boundscheck.dpatch, put it into
debian/patches, add it to the patch list and maybe upload to
testing-proposed-updates.

Thanks for considering,

Martin

-- 
Martin Pitt                 Debian GNU/Linux Developer
martin@piware.de                      mpitt@debian.org
http://www.piware.de             http://www.debian.org

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 267092-done@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>

To: 267092-done@bugs.debian.org

Subject: Re: qt-x11-free: [CAN-2004-0691][CAN-2004-0692][CAN-2004-0693] Qt Image Handling Buffer Overflow Vulnerability

Date: Tue, 21 Sep 2004 16:42:17 -0700

[Message part 1 (text/plain, inline)]

Version 3.3.3 of qt-x11-free, which fixes this bug, has reached sarge; I
am therefore closing this bug report.

-- 
Steve Langasek
postmodern programmer

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.