Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 384103 (CVE-2011-3193) - <dev-qt/qtcore-4.7.4-r1: Insecure Library Loading and Buffer Overflow Vulnerabilities (CVE-2011-3193)
Summary: <dev-qt/qtcore-4.7.4-r1: Insecure Library Loading and Buffer Overflow Vulnera...
Status: RESOLVED FIXED
Alias: CVE-2011-3193
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://secunia.com/advisories/41537/
Whiteboard: B2 [glsa]
Keywords:
Depends on: qt-4.7.4-stable
Blocks:
  Show dependency tree
 
Reported: 2011-09-22 15:21 UTC by Agostino Sarubbo
Modified: 2013-11-22 11:10 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2011-09-22 15:21:52 UTC
From secunia security advisor at $URL:

Description:
1) An error due to the "QLibrary::resolve()" method in QtCore4.dll loading libraries (e.g. wintab32.dll and dwmapi.dll in QtGui4.dll) in an insecure manner can be exploited to load arbitrary libraries when an application using this library e.g. opens a file located on a remote WebDAV or SMB share.

Successful exploitation of this vulnerability allows execution of arbitrary code.

This vulnerability is confirmed in version 4.6.3. Other versions may also be affected.

2) An error in the harfbuzz module (src/3rdparty/harfbuzz/src/harfbuzz-gpos.c) when processing certain fonts can be exploited to cause a buffer overflow.

Successful exploitation of this vulnerability may allow execution of arbitrary code.


Solution:
Update to version 4.7.4 or:

Git commit:
https://qt.gitorious.org/qt/qt/commit/9ae6f2f9a57f0c3096d5785913e437953fa6775c
Comment 1 Agostino Sarubbo gentoo-dev 2011-09-22 15:25:43 UTC
@qt

I've omitted the status because 4.7.4 is in tree, but i don't know if you want stabilize all 4.7.4 qt packages now or simply patch the current.
Comment 2 Agostino Sarubbo gentoo-dev 2011-12-01 23:09:50 UTC
Since qt 4.7.4 is ready for stabilization and after talked with Davide(pesa) on irc, I add this bug as a blocker for the qt-stabilization tracker ( bug 390963 ).

We fast stabilize asap after the patch on bug 384089 will be applied
Comment 3 Tim Sammut (RETIRED) gentoo-dev 2011-12-18 22:10:42 UTC
Unless I am mistaken, we should depend on qt-4.7.4 not block it. Please do correct me if I have it wrong. tnx.
Comment 4 Tim Sammut (RETIRED) gentoo-dev 2012-05-15 06:36:54 UTC
Thanks, everyone. GLSA request filed.
Comment 5 Johannes Huber (RETIRED) gentoo-dev 2012-07-09 11:46:57 UTC
Thank you all. Affected version removed from tree. Removing qt from CC, nothing to do here for us anymore.
Comment 6 GLSAMaker/CVETool Bot gentoo-dev 2012-07-12 00:36:50 UTC
CVE-2011-3193 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3193):
  Heap-based buffer overflow in the Lookup_MarkMarkPos function in the
  HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango,
  allows remote attackers to cause a denial of service (crash) and possibly
  execute arbitrary code via a crafted font file.
Comment 7 GLSAMaker/CVETool Bot gentoo-dev 2013-11-22 11:10:26 UTC
This issue was resolved and addressed in
 GLSA 201311-14 at http://security.gentoo.org/glsa/glsa-201311-14.xml
by GLSA coordinator Sergey Popov (pinkbyte).