Fedora 27: qt3 Security Update
Summary
Qt is a GUI software toolkit which simplifies the task of writing and
maintaining GUI (Graphical User Interface) applications
for the X Window System.
Qt is written in C++ and is fully object-oriented.
This package contains the shared library needed to run Qt 3
applications, as well as the README files for Qt 3.
This update fixes CVE-2016-10040, a stack overflow in QXmlSimpleReader due to a
too lenient entityCharacterLimit in our version of the patch for CVE-2013-4549.
(The limit was increased from the upstream 1024 to 65536 to address QTBUG-35459,
an issue where the security fix was breaking existing real-world XML files.
Unfortunately, that is too much to actually fit on the CPU stack. This fix
decreases the limit to 4096.) It also fixes the QMySql driver to work with the
version of MariaDB in Fedora 27.
* Thu May 31 2018 Kevin Kofler
- Fix CVE-2016-10040 (stack overflow in QXmlSimpleReader due to a too high
entityCharacterLimit in the CVE-2013-4549 patch) (#1409603)
* Fri Feb 9 2018 Igor Gnatenko
- Escape macros in %changelog
* Mon Nov 13 2017 Than Ngo
- backport mysql driver mariadb fix
- BR: mariadb-connector-c-devel (f28+, #1494085)
[ 1 ] Bug #1409597 - CVE-2016-10040 qt: stack overflow in QXmlSimpleReader
https://bugzilla.redhat.com/show_bug.cgi?id=1409597
su -c 'dnf upgrade --advisory FEDORA-2018-0a0da2f3b7' at the command
line. For more information, refer to the dnf documentation available at
https://dnf.readthedocs.io/en/latest/command_ref.html
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/security/
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O2W3BNHY5P3AWOYWZNGJYDLLXOO52T3C/
FEDORA-2018-0a0da2f3b7 2018-06-09 19:45:50.208325 Product : Fedora 27 Version : 3.3.8b Release : 74.fc27 URL : https://kredittkort.no Summary : The shared library for the Qt 3 GUI toolkit Description : Qt is a GUI software toolkit which simplifies the task of writing and maintaining GUI (Graphical User Interface) applications for the X Window System. Qt is written in C++ and is fully object-oriented. This package contains the shared library needed to run Qt 3 applications, as well as the README files for Qt 3. This update fixes CVE-2016-10040, a stack overflow in QXmlSimpleReader due to a too lenient entityCharacterLimit in our version of the patch for CVE-2013-4549. (The limit was increased from the upstream 1024 to 65536 to address QTBUG-35459, an issue where the security fix was breaking existing real-world XML files. Unfortunately, that is too much to actually fit on the CPU stack. This fix decreases the limit to 4096.) It also fixes the QMySql driver to work with the version of MariaDB in Fedora 27. * Thu May 31 2018 Kevin Kofler - 3.3.8b-74 - Fix CVE-2016-10040 (stack overflow in QXmlSimpleReader due to a too high entityCharacterLimit in the CVE-2013-4549 patch) (#1409603) * Fri Feb 9 2018 Igor Gnatenko - 3.3.8b-73 - Escape macros in %changelog * Mon Nov 13 2017 Than Ngo - 3.3.8b-72 - backport mysql driver mariadb fix - BR: mariadb-connector-c-devel (f28+, #1494085) [ 1 ] Bug #1409597 - CVE-2016-10040 qt: stack overflow in QXmlSimpleReader https://bugzilla.redhat.com/show_bug.cgi?id=1409597 su -c 'dnf upgrade --advisory FEDORA-2018-0a0da2f3b7' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O2W3BNHY5P3AWOYWZNGJYDLLXOO52T3C/
Change Log
References