| Summary: | qt4 new security issue CVE-2020-27471 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | major | ||
| Priority: | Normal | CC: | andrewsfarm, davidwhodgins, fri, herman.viaene, mageia, sysadmin-bugs, tarazed25 |
| Version: | 8 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8-64-OK | ||
| Source RPM: | qt4-4.8.7-35.1.mga8.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2021-10-28 20:45:54 CEST
David Walser
2021-10-28 20:46:07 CEST
Whiteboard:
(none) =>
MGA8TOO fixed in mga8/9
src:
- qt4-4.8.7-35.2.mga8Version:
Cauldron =>
8 RPMS: qt4-examples-4.8.7-35.2.mga8 libqt4-devel-4.8.7-35.2.mga8 qt4-demos-4.8.7-35.2.mga8 libqtgui4-4.8.7-35.2.mga8 libqtdesigner4-4.8.7-35.2.mga8 qt4-doc-4.8.7-35.2.mga8 qt4-common-4.8.7-35.2.mga8 qt4-devel-private-4.8.7-35.2.mga8 libqtdeclarative4-4.8.7-35.2.mga8 libqtcore4-4.8.7-35.2.mga8 libqtxmlpatterns4-4.8.7-35.2.mga8 libqt3support4-4.8.7-35.2.mga8 qt4-qvfb-4.8.7-35.2.mga8 libqtscript4-4.8.7-35.2.mga8 qt4-linguist-4.8.7-35.2.mga8 qt4-designer-4.8.7-35.2.mga8 qt4-assistant-4.8.7-35.2.mga8 qt4-qdoc3-4.8.7-35.2.mga8 qt4-qmlviewer-4.8.7-35.2.mga8 libqtnetwork4-4.8.7-35.2.mga8 libqtclucene4-4.8.7-35.2.mga8 libqtopengl4-4.8.7-35.2.mga8 libqtdbus4-4.8.7-35.2.mga8 libqtscripttools4-4.8.7-35.2.mga8 libqthelp4-4.8.7-35.2.mga8 qt4-qtconfig-4.8.7-35.2.mga8 libqtsvg4-4.8.7-35.2.mga8 qt4-accessibility-plugin-4.8.7-35.2.mga8 libqtsql4-4.8.7-35.2.mga8 libqtxml4-4.8.7-35.2.mga8 qt4-designer-plugin-qt3support-4.8.7-35.2.mga8 libqtmultimedia4-4.8.7-35.2.mga8 libqt4-database-plugin-pgsql-4.8.7-35.2.mga8 qt4-qtdbus-4.8.7-35.2.mga8 libqttest4-4.8.7-35.2.mga8 libqt4-database-plugin-mysql-4.8.7-35.2.mga8 libqt4-database-plugin-sqlite-4.8.7-35.2.mga8 libqt4-database-plugin-tds-4.8.7-35.2.mga8 qt4-xmlpatterns-4.8.7-35.2.mga8 qt4-graphicssystems-plugin-4.8.7-35.2.mga8 OK for me on mga8-64 Plasma, nvidia-current I have not checked what they are used for, and i only had a few of the packages to update: - lib64qt3support4-4.8.7-35.2.mga8.x86_64 - lib64qtcore4-4.8.7-35.2.mga8.x86_64 - lib64qtdbus4-4.8.7-35.2.mga8.x86_64 - lib64qtgui4-4.8.7-35.2.mga8.x86_64 - lib64qtnetwork4-4.8.7-35.2.mga8.x86_64 - lib64qtopengl4-4.8.7-35.2.mga8.x86_64 - lib64qtsql4-4.8.7-35.2.mga8.x86_64 - lib64qtsvg4-4.8.7-35.2.mga8.x86_64 - lib64qtxml4-4.8.7-35.2.mga8.x86_64 - qt4-common-4.8.7-35.2.mga8.x86_64 Clean install, reboot, using some applications and will keep using. CC:
(none) =>
fri MGA8-64 Plasma on Lenovo B50 No installation issues. For testing ref bug 26505, so rebooted OK and opened LO-files odt, ods, odp and odm, all with success. CC:
(none) =>
herman.viaene MGA8-64 Plasma, i5-2500, Intel graphics, wired Internet connection. The following 8 packages are going to be installed: - lib64qtcore4-4.8.7-35.2.mga8.x86_64 - lib64qtgui4-4.8.7-35.2.mga8.x86_64 - lib64qtnetwork4-4.8.7-35.2.mga8.x86_64 - lib64qtopengl4-4.8.7-35.2.mga8.x86_64 - lib64qtsql4-4.8.7-35.2.mga8.x86_64 - lib64qtsvg4-4.8.7-35.2.mga8.x86_64 - lib64qtxml4-4.8.7-35.2.mga8.x86_64 - qt4-common-4.8.7-35.2.mga8.x86_64 No installation issues. I tried opening this and that QT application, not knowing if they use these libraries or not, and didn't see any issues. I too will run this for a couple of days, to see if anything turns up. CC:
(none) =>
andrewsfarm mga8, x64
Installed the whole stack pre-update then updated it smoothly with qarepo and MageiaUpdate.
There are a lot of interdepebdences listed in the requires list and a few external applications. One is andromeda. Installed that, no man page but a web search reveals that it is a file manager. When launched it presents a basic gui and launches what appears to be the native file manager, caja for Mate. It is a bit of a mystery what the qt4 interface is for. Might be better to test it under Plasma.
Ran a trace on it and scored a few hits on qt4, mainly plugins.
$ grep qt4 andromeda.trace
......
openat(AT_FDCWD, "/usr/lib64/qt4/plugins/inputmethods", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 7
statfs("/usr/lib64/qt4/plugins/inputmethods/", {f_type=EXT2_SUPER_MAGIC, f_bsize=4096, f_blocks=13852984, f_bfree=9798669, f_bavail=9087540, f_files=3538944, f_ffree=2977798, f_namelen=255, f_frsize=4096, f_flags=ST_VALID|ST_RELATIME}) = 0
......
openat(AT_FDCWD, "/usr/lib64/qt4/plugins/iconengines", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 9
.....
$ rpm -qilp qt4-demos-4.8.7-35.2.mga8.x86_64.rpm
.....
Packager : neoclust <neoclust>
Vendor : Mageia.Org
URL : http://qt-project.org/
Summary : Demonstration applications with Qt4
.....
/usr/lib64/qt4/bin/qtdemo
/usr/lib64/qt4/demos
/usr/lib64/qt4/demos/README
/usr/lib64/qt4/demos/affine
/usr/lib64/qt4/demos/affine/affine
/usr/lib64/qt4/demos/affine/affine.pro
/usr/lib64/qt4/demos/affine/affine.qrc
/usr/lib64/qt4/demos/affine/bg1.jpg
/usr/lib64/qt4/demos/affine/main.cpp
/usr/lib64/qt4/demos/affine/xform.cpp
/usr/lib64/qt4/demos/affine/xform.h
/usr/lib64/qt4/demos/affine/xform.html
/usr/lib64/qt4/demos/arthurplugin
/usr/lib64/qt4/demos/arthurplugin/arthur_plugin.qrc
/usr/lib64/qt4/demos/arthurplugin/arthurplugin.pro
......
$ file /usr/lib64/qt4/bin/qtdemo
/usr/lib64/qt4/bin/qtdemo: ELF 64-bit LSB executable, x86-64, version 1.....
Running that presents the QT examples and demos gui. That all works very smoothly. You could play with it for hours.
qt4 looks good from here.CC:
(none) =>
tarazed25 No problems since installing, and a couple of good-looking tests. Sending this on. Validating. Keywords:
(none) =>
validated_update
Dave Hodgins
2021-11-18 18:53:24 CET
CC:
(none) =>
davidwhodgins An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2021-0510.html Status:
NEW =>
RESOLVED |