[UCI-Linux] Fedora Core 1 Update: qt-3.1.2-14.2

Mike Iglesias IGLESIAS at uci.edu
Mon Aug 23 08:35:00 PDT 2004

Message-ID: <4129AB92.10502 at redhat.com>
Date: Mon, 23 Aug 2004 10:32:18 +0200
From: Than Ngo <than at redhat.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.2) Gecko/20040803
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: fedora-announce-list at redhat.com
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-loop: fedora-announce-list at redhat.com
X-Mailman-Approved-At: Mon, 23 Aug 2004 10:57:35 -0400
Subject: [SECURITY] Fedora Core 1 Update: qt-3.1.2-14.2

Subject: Fedora Core 1 Update: qt-3.1.2-14.2

Fedora Update Notification

Product     : Fedora Core 1
Name        : qt
Version     : 3.1.2
Release     : 14.2
Summary     : The shared library for the Qt GUI toolkit.
Description :
Qt is a GUI software toolkit which simplifies the task of writing and
maintaining GUI (Graphical User Interface) applications
for the X Window System.

Qt is written in C++ and is fully object-oriented.

This package contains the shared library needed to run qt
applications, as well as the README files for qt.

Update Information:

During a security audit, Chris Evans discovered a heap overflow in the BMP
image decoder in Qt versions prior to 3.3.3. An attacker could create a
carefully crafted BMP file in such a way that it would cause an application
linked with Qt to crash or possibly execute arbitrary code when the file
was opened by a victim. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0691 to this issue.

Additionally, various flaws were discovered in the GIF, XPM, and JPEG
decoders in Qt versions prior to 3.3.3. An attacker could create carefully
crafted image files in such a way that it could cause an application linked
against Qt to crash when the file was opened by a victim. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
names CAN-2004-0692 and CAN-2004-0693 to these issues.

Users of Qt should update to these updated packages which contain
backported patches and are not vulnerable to these issues.
* Thu Aug 19 2004 Than Ngo <than at redhat.com> 1:3.1.2-14.2

- fix image buffer overflows

* Thu Jul 29 2004 Than Ngo <than at redhat.com> 1:3.1.2-14.1

- fix overflow vulnerability, thanks to trolltech

This update can be downloaded from:

c763ada78b47f3bc72a06e26b929c8c4  SRPMS/qt-3.1.2-14.2.src.rpm
f86739a73579c5b6b698a873b4446d22  x86_64/qt-3.1.2-14.2.x86_64.rpm
6110ba73b9bbce08df7f8529d8185a51  x86_64/qt-devel-3.1.2-14.2.x86_64.rpm
86aad3b91aef11b01da1c816cccaffbe  x86_64/qt-ODBC-3.1.2-14.2.x86_64.rpm
fb94f45a83cabdfb45751fd293be2ccc  x86_64/qt-MySQL-3.1.2-14.2.x86_64.rpm
d4077aa9c95b065b89512e8937d3895d  x86_64/qt-PostgreSQL-3.1.2-14.2.x86_64.rpm
2dce1a5d23a9f763f34b0f180cf5d5a1  x86_64/qt-designer-3.1.2-14.2.x86_64.rpm
aca527b50ab8b71bbb7e4a6e93278173  i386/qt-3.1.2-14.2.i386.rpm
d800a0e0f24c5c748c0e6d4d0cbc766d  i386/qt-devel-3.1.2-14.2.i386.rpm
8dc18024573a730fd625a54c4283be63  i386/qt-ODBC-3.1.2-14.2.i386.rpm
62785195ce484b82c388c3bc38992895  i386/qt-MySQL-3.1.2-14.2.i386.rpm
586469add7922ac224dcdc24819ce284  i386/qt-PostgreSQL-3.1.2-14.2.i386.rpm
263b2d0b195ab4869be6f4074df1c728  i386/qt-designer-3.1.2-14.2.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.

fedora-announce-list mailing list
fedora-announce-list at redhat.com

More information about the UCI-Linux mailing list