Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 11.04 and 10.04 LTS USN-1504-1 Critical Denial Of Service

ubuntu
Calendar Grey July 11, 2012
Scroller Ubuntu
Significant weaknesses in Qt on Ubuntu have been discovered, which may result in system crashes or enable unauthorized activities through specifically designed files.
Qt Applications could be made to crash or run programs as your login if they opened specially crafted files.

Summary

Qt Applications could be made to crash or run programs as your login if

they opened specially crafted files.

Software Description:

- qt4-x11: transitional package for Qt 4 assistant module

Details:

It was discovered that Qt did not properly handle wildcard domain names or

IP addresses in the Common Name field of X.509 certificates. An attacker

could exploit this to perform a man in the middle attack to view sensitive

information or alter encrypted communications. This issue only affected

Ubuntu 10.04 LTS. (CVE-2010-5076)

A heap-based buffer overflow was discovered in the HarfBuzz module. If a

user were tricked into opening a crafted font file in a Qt application,

an attacker could cause a denial of service or possibly execute arbitrary

code with the privileges of the user invoking the program. (CVE-2011-3193)

It was discovered that Qt did not properly handle greyscale TIFF images.

If a Qt application could be made to process a crafted TIFF file, an

attack...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu authentication issue update instructions Qt

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  libqt4-network                  4:4.7.2-0ubuntu6.4
  libqtgui4                       4:4.7.2-0ubuntu6.4

Ubuntu 10.04 LTS:
  libqt4-network                  4:4.6.2-0ubuntu5.4
  libqtgui4                       4:4.6.2-0ubuntu5.4

After a standard system update you need to restart your session to make all
the necessary changes.

References

https://ubuntu.com/security/notices/USN-1504-1

CVE-2010-5076, CVE-2011-3193, CVE-2011-3194

Severity
critical
Lowest
Low
Medium
High
Critical

July 11, 2012

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu authentication issue update instructions Qt

Package Information

https://launchpad.net/ubuntu/+source/qt4-x11/4:4.7.2-0ubuntu6.4
https://launchpad.net/ubuntu/+source/qt4-x11/4:4.6.2-0ubuntu5.4

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.