[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#1002991: marked as done (qtsvg-opensource-src: CVE-2021-45930)

Your message dated Sun, 09 Jan 2022 13:48:47 +0000
with message-id <E1n6YYx-000EYK-Gx@fasolo.debian.org>
and subject line Bug#1002991: fixed in qtsvg-opensource-src 5.15.2-4
has caused the Debian Bug report #1002991,
regarding qtsvg-opensource-src: CVE-2021-45930
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1002991: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002991
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Source: qtsvg-opensource-src
Version: 5.15.2-3
Severity: important
Tags: security upstream
Forwarded: https://bugreports.qt.io/browse/QTBUG-96044
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 5.11.3-2

Hi,

The following vulnerability was published for qtsvg-opensource-src.

CVE-2021-45930[0]:
| Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-
| of-bounds write in
| QtPrivate::QCommonArrayOps&lt;QPainterPath::Element&gt;::growAppend
| (called from QPainterPath::addPath and QPathClipper::intersect).

Note that for 5.12.y it was fixed with [6] in 5.12.12, but remains
unfixed in 5.15.2. The corresponding QT bug does not seem public,
still marking it as forwarded there.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-45930
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45930
[1] https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37025
[2] https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37306
[3] https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-1121.yaml
[4] https://github.com/qt/qtsvg/commit/36cfd9efb9b22b891adee9c48d30202289cfa620 (dev)
[5] https://github.com/qt/qtsvg/commit/79bb9f51fa374106a612d17c9d98d35d807be670 (v6.2.2)
[6] https://github.com/qt/qtsvg/commit/a3b753c2d077313fc9eb93af547051b956e383fc (v5.12.12)
[7] https://bugreports.qt.io/browse/QTBUG-96044

Regards,
Salvatore

--- End Message ---
--- Begin Message --- 
Source: qtsvg-opensource-src
Source-Version: 5.15.2-4
Done: Dmitry Shachnev <mitya57@debian.org>

We believe that the bug you reported is fixed in the latest version of
qtsvg-opensource-src, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1002991@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Dmitry Shachnev <mitya57@debian.org> (supplier of updated qtsvg-opensource-src package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 09 Jan 2022 16:26:35 +0300
Source: qtsvg-opensource-src
Architecture: source
Version: 5.15.2-4
Distribution: unstable
Urgency: medium
Maintainer: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Changed-By: Dmitry Shachnev <mitya57@debian.org>
Closes: 1002991
Changes:
 qtsvg-opensource-src (5.15.2-4) unstable; urgency=medium
 .
   * Backport upstream commit to do stricter error checking when parsing path
     nodes (CVE-2021-45930, closes: #1002991).
   * Backport upstream commit to reject oversize SVGs as corrupt.
   * Bump Standards-Version to 4.6.0, no changes needed.
Checksums-Sha1:
 1e4a7fc4e58555075520b5588a2bedbab262d0c7 2901 qtsvg-opensource-src_5.15.2-4.dsc
 3c9b42bccf1cc24647fcc9c484b1417550b3b9cd 14188 qtsvg-opensource-src_5.15.2-4.debian.tar.xz
 5563b3cc5d31d91c478bdd485c32f7b2e83ef14f 12575 qtsvg-opensource-src_5.15.2-4_source.buildinfo
Checksums-Sha256:
 6e4f433a981d20f9484933858866e5f0e69b291c50fff7c179f76ed23ae6cc58 2901 qtsvg-opensource-src_5.15.2-4.dsc
 3e55ebb6eb48953dc17526c37634c7fe90188e338dfb59b2512f73a9e42cae4f 14188 qtsvg-opensource-src_5.15.2-4.debian.tar.xz
 70a883b5031ca29166754b82b16a21bd90041875d1485a854c405072b5a85b80 12575 qtsvg-opensource-src_5.15.2-4_source.buildinfo
Files:
 2892337417aa8db9016326d841bc21d0 2901 libs optional qtsvg-opensource-src_5.15.2-4.dsc
 19c695c70b8585ecd35f53b75adde8d0 14188 libs optional qtsvg-opensource-src_5.15.2-4.debian.tar.xz
 1a99beab02be94c2c99605e685facb98 12575 libs optional qtsvg-opensource-src_5.15.2-4_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJHBAEBCgAxFiEE5688gqe4PSusUZcLZkYmW1hrg8sFAmHa4xETHG1pdHlhNTdA
ZGViaWFuLm9yZwAKCRBmRiZbWGuDy7WeEACg+b7MBOOVYzZ/0NLAMfFcZ/M430dN
09ZOkdcJf5A5vMyJt7kCoEYVtojplG77S3FmIBXvUXgmjMANZu0KnULLnyZhHLoh
nc9WGa6t2/3zS67bs2PPTt7qQbDTo7LHl2+u/UuBhR3nD7JZnoNP/0nWC52xzlH2
f908jZRWe8BvY6Dbkc9uqCUGLAp9pSsqAXLr1hEDsSn27IGN6LMwwLVjqIDb80ks
YDZxihW7RUMQsPEKQ5f2RET9L5yB/zf/jDYcEPnIasA7x3R0NCs/+ZvtvULSwYki
c0de4yl5XOlse2Te6/VLGWZnAoDSRYyG5UNbbpFkvF+iKKYxleDBsADRx3XWJqKe
InjbzSzoRj+KblGKuyOwW0CeccAsrxc27dLSOjf0BJ1GSrOuow00Q3XWn39ugVIF
YpByFNIF8g5HjaRZVZNPnMLdwcmg2ANZCm65CeI/T2pNc72U8bTT1lXOAa9f6dG3
fsA/pyu1JlCLo3NqxLS4oUxjixO7SAEPbDuNQS1Ev6nwEf2jIGpSWP4uxxMgpu/3
G5MzvepPciuLCK3v0vz4eivrei4/QlVElS1p2LkM3Kdga0/RUa+BpFmRuZJLViIV
G+HwVN/hZCPcxTFzJhIYsvX1KvAMVWGRFah8Vg782zLPMZZ+oi6ry3Txu9hfHyHV
kWM2C/PxBCoVfQ==
=IDXB
-----END PGP SIGNATURE-----

--- End Message ---
Reply to: