Bug 29602 - qt4 new security issue CVE-2020-27471
Summary: qt4 new security issue CVE-2020-27471
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2021-10-28 20:45 CEST by David Walser
Modified: 2021-11-18 22:52 CET (History)
7 users (show)

See Also:
Source RPM: qt4-4.8.7-35.1.mga8.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2021-10-28 20:45:54 CEST
Fedora has issued an advisory on October 27:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/SEVLZYF3XAD2Q2HTNQP3SIFCQPSXYHAS/

Mageia 8 is also affected.
David Walser 2021-10-28 20:46:07 CEST

Whiteboard: (none) => MGA8TOO
Status comment: (none) => Patch available from Fedora

Comment 1 Nicolas Lécureuil 2021-11-07 00:16:27 CET
fixed in mga8/9

src:
    - qt4-4.8.7-35.2.mga8

Version: Cauldron => 8
Status comment: Patch available from Fedora => (none)
CC: (none) => mageia
Assignee: kde => qa-bugs
Whiteboard: MGA8TOO => (none)

Comment 2 David Walser 2021-11-07 14:08:51 CET
RPMS:
qt4-examples-4.8.7-35.2.mga8
libqt4-devel-4.8.7-35.2.mga8
qt4-demos-4.8.7-35.2.mga8
libqtgui4-4.8.7-35.2.mga8
libqtdesigner4-4.8.7-35.2.mga8
qt4-doc-4.8.7-35.2.mga8
qt4-common-4.8.7-35.2.mga8
qt4-devel-private-4.8.7-35.2.mga8
libqtdeclarative4-4.8.7-35.2.mga8
libqtcore4-4.8.7-35.2.mga8
libqtxmlpatterns4-4.8.7-35.2.mga8
libqt3support4-4.8.7-35.2.mga8
qt4-qvfb-4.8.7-35.2.mga8
libqtscript4-4.8.7-35.2.mga8
qt4-linguist-4.8.7-35.2.mga8
qt4-designer-4.8.7-35.2.mga8
qt4-assistant-4.8.7-35.2.mga8
qt4-qdoc3-4.8.7-35.2.mga8
qt4-qmlviewer-4.8.7-35.2.mga8
libqtnetwork4-4.8.7-35.2.mga8
libqtclucene4-4.8.7-35.2.mga8
libqtopengl4-4.8.7-35.2.mga8
libqtdbus4-4.8.7-35.2.mga8
libqtscripttools4-4.8.7-35.2.mga8
libqthelp4-4.8.7-35.2.mga8
qt4-qtconfig-4.8.7-35.2.mga8
libqtsvg4-4.8.7-35.2.mga8
qt4-accessibility-plugin-4.8.7-35.2.mga8
libqtsql4-4.8.7-35.2.mga8
libqtxml4-4.8.7-35.2.mga8
qt4-designer-plugin-qt3support-4.8.7-35.2.mga8
libqtmultimedia4-4.8.7-35.2.mga8
libqt4-database-plugin-pgsql-4.8.7-35.2.mga8
qt4-qtdbus-4.8.7-35.2.mga8
libqttest4-4.8.7-35.2.mga8
libqt4-database-plugin-mysql-4.8.7-35.2.mga8
libqt4-database-plugin-sqlite-4.8.7-35.2.mga8
libqt4-database-plugin-tds-4.8.7-35.2.mga8
qt4-xmlpatterns-4.8.7-35.2.mga8
qt4-graphicssystems-plugin-4.8.7-35.2.mga8
Comment 3 Morgan Leijström 2021-11-08 00:23:00 CET
OK for me on mga8-64 Plasma, nvidia-current

I have not checked what they are used for, and i only had a few of the packages to update:

- lib64qt3support4-4.8.7-35.2.mga8.x86_64
- lib64qtcore4-4.8.7-35.2.mga8.x86_64
- lib64qtdbus4-4.8.7-35.2.mga8.x86_64
- lib64qtgui4-4.8.7-35.2.mga8.x86_64
- lib64qtnetwork4-4.8.7-35.2.mga8.x86_64
- lib64qtopengl4-4.8.7-35.2.mga8.x86_64
- lib64qtsql4-4.8.7-35.2.mga8.x86_64
- lib64qtsvg4-4.8.7-35.2.mga8.x86_64
- lib64qtxml4-4.8.7-35.2.mga8.x86_64
- qt4-common-4.8.7-35.2.mga8.x86_64

Clean install, reboot, using some applications and will keep using.

CC: (none) => fri

Comment 4 Herman Viaene 2021-11-10 15:35:02 CET
MGA8-64 Plasma on Lenovo B50
No installation issues.
For testing ref bug 26505, so rebooted OK and opened LO-files odt, ods, odp and odm, all with success.

CC: (none) => herman.viaene

Comment 5 Thomas Andrews 2021-11-13 20:47:45 CET
MGA8-64 Plasma, i5-2500, Intel graphics, wired Internet connection.

The following 8 packages are going to be installed:

- lib64qtcore4-4.8.7-35.2.mga8.x86_64
- lib64qtgui4-4.8.7-35.2.mga8.x86_64
- lib64qtnetwork4-4.8.7-35.2.mga8.x86_64
- lib64qtopengl4-4.8.7-35.2.mga8.x86_64
- lib64qtsql4-4.8.7-35.2.mga8.x86_64
- lib64qtsvg4-4.8.7-35.2.mga8.x86_64
- lib64qtxml4-4.8.7-35.2.mga8.x86_64
- qt4-common-4.8.7-35.2.mga8.x86_64

No installation issues. I tried opening this and that QT application, not knowing if they use these libraries or not, and didn't see any issues. I too will run this for a couple of days, to see if anything turns up.

CC: (none) => andrewsfarm

Comment 6 Len Lawrence 2021-11-14 00:05:19 CET
mga8, x64
Installed the whole stack pre-update then updated it smoothly with qarepo and MageiaUpdate.
There are a lot of interdepebdences listed in the requires list and a few external applications.  One is andromeda.  Installed that, no man page but a web search reveals that it is a file manager.  When launched it presents a basic gui and launches what appears to be the native file manager, caja for Mate.  It is a bit of a mystery what the qt4 interface is for.  Might be better to test it under Plasma.
Ran a trace on it and scored a few hits on qt4, mainly plugins.
$ grep qt4 andromeda.trace
......
openat(AT_FDCWD, "/usr/lib64/qt4/plugins/inputmethods", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 7
statfs("/usr/lib64/qt4/plugins/inputmethods/", {f_type=EXT2_SUPER_MAGIC, f_bsize=4096, f_blocks=13852984, f_bfree=9798669, f_bavail=9087540, f_files=3538944, f_ffree=2977798, f_namelen=255, f_frsize=4096, f_flags=ST_VALID|ST_RELATIME}) = 0
......
openat(AT_FDCWD, "/usr/lib64/qt4/plugins/iconengines", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 9
.....

$ rpm -qilp qt4-demos-4.8.7-35.2.mga8.x86_64.rpm
.....
Packager    : neoclust <neoclust>
Vendor      : Mageia.Org
URL         : http://qt-project.org/
Summary     : Demonstration applications with Qt4
.....
/usr/lib64/qt4/bin/qtdemo
/usr/lib64/qt4/demos
/usr/lib64/qt4/demos/README
/usr/lib64/qt4/demos/affine
/usr/lib64/qt4/demos/affine/affine
/usr/lib64/qt4/demos/affine/affine.pro
/usr/lib64/qt4/demos/affine/affine.qrc
/usr/lib64/qt4/demos/affine/bg1.jpg
/usr/lib64/qt4/demos/affine/main.cpp
/usr/lib64/qt4/demos/affine/xform.cpp
/usr/lib64/qt4/demos/affine/xform.h
/usr/lib64/qt4/demos/affine/xform.html
/usr/lib64/qt4/demos/arthurplugin
/usr/lib64/qt4/demos/arthurplugin/arthur_plugin.qrc
/usr/lib64/qt4/demos/arthurplugin/arthurplugin.pro
......
$ file /usr/lib64/qt4/bin/qtdemo
/usr/lib64/qt4/bin/qtdemo: ELF 64-bit LSB executable, x86-64, version 1.....

Running that presents the QT examples and demos gui.  That all works very smoothly.  You could play with it for hours.

qt4 looks good from here.

CC: (none) => tarazed25

Comment 7 Thomas Andrews 2021-11-17 22:00:05 CET
No problems since installing, and a couple of good-looking tests. Sending this on.

Validating.

Keywords: (none) => validated_update
Whiteboard: (none) => MGA8-64-OK
CC: (none) => sysadmin-bugs

Dave Hodgins 2021-11-18 18:53:24 CET

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 8 Mageia Robot 2021-11-18 22:52:20 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0510.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.