A use-after-free was discovered in QtGui's Markdown handling code possibly allowing a remote attacker to execute arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202007-38 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: QtGui: Arbitrary code execution Date: July 27, 2020 Bugs: #719732 ID: 202007-38 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A use-after-free was discovered in QtGui's Markdown handling code possibly allowing a remote attacker to execute arbitrary code. Background ========= QtGui is a module for the Qt toolkit. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-qt/qtgui < 5.14.2 > = 5.14.2 Description ========== QtGui's setMarkdown has a use-after-free related to QTextMarkdownImporter::insertBlock. Impact ===== A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition. Workaround ========= There is no known workaround at this time. Resolution ========= All QtGui users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-qt/qtgui-5.14.2" Note that the Qt suite is best kept in sync, so a world upgrade may be advisable to keep your system in a good state. References ========= [ 1 ] CVE-2020-12267 https://nvd.nist.gov/vuln/detail/CVE-2020-12267 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202007-38 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
A NULL pointer dereference in QtGui could lead to Denial of Service.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201412-25 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: QtGui: Denial of Service Date: December 13, 2014 Bugs: #508984 ID: 201412-25 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A NULL pointer dereference in QtGui could lead to Denial of Service. Background ========= QtGui is the GUI module and platform plugins for the Qt5 framework. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-qt/qtgui < 4.8.5-r2 > = 4.8.5-r2 Description ========== A NULL pointer dereference has been found in QtGui. Impact ===== A remote attacker could send a specially crafted GIF image, possibly resulting in a Denial of Service condition. Workaround ========= There is no known workaround at this time. Resolution ========= All QtGui users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-qt/qtgui-4.8.5-r2" References ========= [ 1 ] CVE-2014-0190 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0190 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201412-25 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Get the latest Linux and open source security news straight to your inbox.