Bug 719732 – <dev-qt/qtgui-5.14.2: Use-after-free in QTextMarkdownImporter (CVE-2020-12267)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2020-04-27 04:51:21 UTC]

CVE-2020-12267 (https://nvd.nist.gov/vuln/detail/CVE-2020-12267):
  setMarkdown in Qt before 5.14.2 has a use-after-free related to
  QTextMarkdownImporter::insertBlock.

[Comment 1 Andreas Sturmlechner 2020-04-28 20:53:29 UTC]

*** Bug 716992 has been marked as a duplicate of this bug. ***

[Comment 2 Andreas Sturmlechner 2020-04-28 21:09:48 UTC]

First-time stabilisations:

dev-qt/qtdiag-5.14.2 amd64 x86 (see bug 718754)
dev-qt/qtcharts-5.14.2 amd64 arm64 x86 (for kuserfeedback, used by plasma-workspace)

Any objections?

[Comment 3 Davide Pesavento 2020-04-28 21:14:01 UTC]

(In reply to Andreas Sturmlechner from comment #2)
> First-time stabilisations:
> 
> dev-qt/qtdiag-5.14.2 amd64 x86 (see bug 718754)
> dev-qt/qtcharts-5.14.2 amd64 arm64 x86 (for kuserfeedback, used by
> plasma-workspace)
> 
> Any objections?
Sounds good to me.

[Comment 4 Andreas Sturmlechner 2020-04-29 10:10:38 UTC]

Reason for the regression with horizontal scrollbars appearing when they shouldn't (https://bugs.kde.org/show_bug.cgi?id=419514) was identified as commit a82b1b27 in qtdeclarative, that is still to be fixed before we add arches.

[Comment 5 Andreas Sturmlechner 2020-05-07 08:54:32 UTC]

Adding arm and ppc64 ahead of the pack, no stable keyword on qtwebengine so no coordination required.

[Comment 6 NATTkA bot 2020-05-07 08:57:14 UTC]

Sanity check failed:

> dev-qt/qtwebview-5.14.2
>   depend arm stable profile default/linux/arm/17.0 (19 total)
>     ~dev-qt/qtwebengine-5.14.2
>   depend arm dev profile default/linux/arm/17.0/armv4 (35 total)
>     ~dev-qt/qtwebengine-5.14.2
>   rdepend arm stable profile default/linux/arm/17.0 (19 total)
>     ~dev-qt/qtwebengine-5.14.2
>   rdepend arm dev profile default/linux/arm/17.0/armv4 (35 total)
>     ~dev-qt/qtwebengine-5.14.2

[Comment 7 Andreas Sturmlechner 2020-05-07 09:12:33 UTC]

Cleanup some stray entries that should not be in package list.

[Comment 8 NATTkA bot 2020-05-07 09:17:15 UTC]

All sanity-check issues have been resolved

[Comment 9 Andreas Sturmlechner 2020-05-07 11:30:15 UTC]

Adding kde-apps/dolphin-19.12.3-r1 which has a fix specifically for Qt 5.14.2, commit 99ec5f37.

[Comment 10 Agostino Sarubbo 2020-05-09 07:44:12 UTC]

arm stable

[Comment 11 Agostino Sarubbo 2020-05-09 07:47:15 UTC]

ppc64 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.

[Comment 12 Andreas Sturmlechner 2020-05-09 07:48:31 UTC]

Thanks ago, but other arches are not there yet. ;)

[Comment 13 Andreas Sturmlechner 2020-05-09 08:40:06 UTC]

*** Bug 718754 has been marked as a duplicate of this bug. ***

[Comment 14 Andreas Sturmlechner 2020-05-17 00:29:55 UTC]

Bumping dev-qt/qtdeclarative-5.14.2-r1 for a UI fix.

[Comment 15 Andreas Sturmlechner 2020-05-19 19:20:22 UTC]

Arches please stabilise. If at all possible, please stabilise at the same time with:
bug 720172
bug 723414
bug 716822
bug 723404

[Comment 16 Mikle Kolyada (RETIRED) 2020-05-19 19:31:53 UTC]

amd64 stable

[Comment 17 Mikle Kolyada (RETIRED) 2020-05-20 09:50:21 UTC]

x86 stable

[Comment 18 Mikle Kolyada (RETIRED) 2020-05-20 13:31:52 UTC]

arm64 stable

[Comment 19 Sergei Trofimovich (RETIRED) 2020-05-22 08:19:08 UTC]

ppc64 stable

[Comment 20 Sergei Trofimovich (RETIRED) 2020-05-30 19:54:21 UTC]

ppc stable

[Comment 21 Larry the Git Cow 2020-05-30 20:58:03 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bc400dc11d5dae40db820619210e49adff1f4306

commit bc400dc11d5dae40db820619210e49adff1f4306
Author:     Andreas Sturmlechner <[e-mail]>
AuthorDate: 2020-05-30 20:06:48 +0000
Commit:     Andreas Sturmlechner <[e-mail]>
CommitDate: 2020-05-30 20:46:00 +0000

    dev-qt: Drop Qt 5.14.1 and vulnerable dev-qt/qtgui
    
    Bug: https://bugs.gentoo.org/719732
    Package-Manager: Portage-2.3.100, Repoman-2.3.22
    Signed-off-by: Andreas Sturmlechner <[e-mail]>

 dev-qt/assistant/Manifest                          |   1 -
 dev-qt/assistant/assistant-5.14.1.ebuild           |  55 ------
 dev-qt/designer/Manifest                           |   1 -
 dev-qt/designer/designer-5.14.1.ebuild             |  57 -------
 dev-qt/linguist-tools/Manifest                     |   1 -
 dev-qt/linguist-tools/linguist-tools-5.14.1.ebuild |  35 ----
 dev-qt/linguist/Manifest                           |   1 -
 dev-qt/linguist/linguist-5.14.1.ebuild             |  48 ------
 dev-qt/pixeltool/Manifest                          |   1 -
 dev-qt/pixeltool/pixeltool-5.14.1.ebuild           |  25 ---
 dev-qt/qdbus/Manifest                              |   1 -
 dev-qt/qdbus/qdbus-5.14.1.ebuild                   |  25 ---
 dev-qt/qdbusviewer/Manifest                        |   1 -
 dev-qt/qdbusviewer/qdbusviewer-5.14.1.ebuild       |  45 -----
 dev-qt/qdoc/Manifest                               |   1 -
 dev-qt/qdoc/qdoc-5.14.1.ebuild                     |  40 -----
 dev-qt/qt-docs/Manifest                            |  54 ------
 dev-qt/qt-docs/qt-docs-5.14.1_p202001241012.ebuild |  89 ----------
 dev-qt/qt3d/Manifest                               |   1 -
 dev-qt/qt3d/qt3d-5.14.1-r1.ebuild                  |  34 ----
 dev-qt/qtbluetooth/Manifest                        |   1 -
 .../files/qtbluetooth-5.14.1-errno.patch           |  25 ---
 dev-qt/qtbluetooth/qtbluetooth-5.14.1.ebuild       |  35 ----
 dev-qt/qtcharts/Manifest                           |   1 -
 dev-qt/qtcharts/qtcharts-5.14.1.ebuild             |  29 ----
 dev-qt/qtconcurrent/Manifest                       |   1 -
 dev-qt/qtconcurrent/qtconcurrent-5.14.1.ebuild     |  23 ---
 dev-qt/qtcore/Manifest                             |   1 -
 dev-qt/qtcore/qtcore-5.14.1-r1.ebuild              |  85 ----------
 dev-qt/qtdatavis3d/Manifest                        |   1 -
 dev-qt/qtdatavis3d/qtdatavis3d-5.14.1-r1.ebuild    |  31 ----
 dev-qt/qtdbus/Manifest                             |   1 -
 dev-qt/qtdbus/qtdbus-5.14.1.ebuild                 |  43 -----
 dev-qt/qtdeclarative/Manifest                      |   1 -
 .../qtdeclarative/qtdeclarative-5.14.1-r2.ebuild   |  53 ------
 dev-qt/qtdiag/Manifest                             |   1 -
 dev-qt/qtdiag/qtdiag-5.14.1.ebuild                 |  36 ----
 dev-qt/qtgamepad/Manifest                          |   1 -
 dev-qt/qtgamepad/qtgamepad-5.14.1.ebuild           |  35 ----
 dev-qt/qtgraphicaleffects/Manifest                 |   1 -
 .../qtgraphicaleffects-5.14.1.ebuild               |  21 ---
 dev-qt/qtgui/Manifest                              |   1 -
 dev-qt/qtgui/qtgui-5.14.1-r4.ebuild                | 184 ---------------------
 dev-qt/qthelp/Manifest                             |   1 -
 dev-qt/qthelp/qthelp-5.14.1.ebuild                 |  29 ----
 dev-qt/qtimageformats/Manifest                     |   1 -
 dev-qt/qtimageformats/qtimageformats-5.14.1.ebuild |  30 ----
 dev-qt/qtlocation/Manifest                         |   1 -
 dev-qt/qtlocation/qtlocation-5.14.1.ebuild         |  45 -----
 dev-qt/qtmultimedia/Manifest                       |   1 -
 dev-qt/qtmultimedia/qtmultimedia-5.14.1-r1.ebuild  |  68 --------
 dev-qt/qtnetwork/Manifest                          |   1 -
 dev-qt/qtnetwork/qtnetwork-5.14.1.ebuild           |  60 -------
 dev-qt/qtnetworkauth/Manifest                      |   1 -
 dev-qt/qtnetworkauth/qtnetworkauth-5.14.1.ebuild   |  20 ---
 dev-qt/qtopengl/Manifest                           |   1 -
 dev-qt/qtopengl/qtopengl-5.14.1-r1.ebuild          |  34 ----
 dev-qt/qtpaths/Manifest                            |   1 -
 dev-qt/qtpaths/qtpaths-5.14.1.ebuild               |  23 ---
 dev-qt/qtplugininfo/Manifest                       |   1 -
 dev-qt/qtplugininfo/qtplugininfo-5.14.1.ebuild     |  23 ---
 dev-qt/qtpositioning/Manifest                      |   1 -
 dev-qt/qtpositioning/qtpositioning-5.14.1.ebuild   |  40 -----
 dev-qt/qtprintsupport/Manifest                     |   1 -
 .../qtprintsupport/qtprintsupport-5.14.1-r1.ebuild |  42 -----
 dev-qt/qtquickcontrols/Manifest                    |   1 -
 .../qtquickcontrols/qtquickcontrols-5.14.1.ebuild  |  32 ----
 dev-qt/qtquickcontrols2/Manifest                   |   1 -
 .../qtquickcontrols2-5.14.1.ebuild                 |  30 ----
 dev-qt/qtscript/Manifest                           |   1 -
 dev-qt/qtscript/qtscript-5.14.1.ebuild             |  36 ----
 dev-qt/qtscxml/Manifest                            |   1 -
 dev-qt/qtscxml/qtscxml-5.14.1.ebuild               |  19 ---
 dev-qt/qtsensors/Manifest                          |   1 -
 dev-qt/qtsensors/qtsensors-5.14.1.ebuild           |  28 ----
 dev-qt/qtserialbus/Manifest                        |   1 -
 dev-qt/qtserialbus/qtserialbus-5.14.1.ebuild       |  20 ---
 dev-qt/qtserialport/Manifest                       |   1 -
 dev-qt/qtserialport/qtserialport-5.14.1.ebuild     |  27 ---
 dev-qt/qtspeech/Manifest                           |   1 -
 dev-qt/qtspeech/qtspeech-5.14.1.ebuild             |  20 ---
 dev-qt/qtsql/Manifest                              |   1 -
 dev-qt/qtsql/qtsql-5.14.1.ebuild                   |  55 ------
 dev-qt/qtsvg/Manifest                              |   1 -
 dev-qt/qtsvg/qtsvg-5.14.1.ebuild                   |  23 ---
 dev-qt/qttest/Manifest                             |   1 -
 dev-qt/qttest/qttest-5.14.1.ebuild                 |  33 ----
 dev-qt/qttranslations/Manifest                     |   1 -
 dev-qt/qttranslations/qttranslations-5.14.1.ebuild |  19 ---
 dev-qt/qtvirtualkeyboard/Manifest                  |   1 -
 .../qtvirtualkeyboard-5.14.1.ebuild                |  43 -----
 dev-qt/qtwayland/Manifest                          |   1 -
 dev-qt/qtwayland/qtwayland-5.14.1-r3.ebuild        |  45 -----
 dev-qt/qtwebchannel/Manifest                       |   1 -
 dev-qt/qtwebchannel/qtwebchannel-5.14.1.ebuild     |  26 ---
 dev-qt/qtwebengine/Manifest                        |   1 -
 .../qtwebengine-5.14.1-detect-ninja-1.10.patch     |  27 ---
 dev-qt/qtwebengine/qtwebengine-5.14.1.ebuild       | 130 ---------------
 dev-qt/qtwebsockets/Manifest                       |   1 -
 dev-qt/qtwebsockets/qtwebsockets-5.14.1.ebuild     |  27 ---
 dev-qt/qtwebview/Manifest                          |   1 -
 dev-qt/qtwebview/qtwebview-5.14.1.ebuild           |  21 ---
 dev-qt/qtwidgets/Manifest                          |   1 -
 dev-qt/qtwidgets/qtwidgets-5.14.1-r1.ebuild        |  57 -------
 dev-qt/qtx11extras/Manifest                        |   1 -
 dev-qt/qtx11extras/qtx11extras-5.14.1.ebuild       |  22 ---
 dev-qt/qtxml/Manifest                              |   1 -
 dev-qt/qtxml/qtxml-5.14.1.ebuild                   |  29 ----
 dev-qt/qtxmlpatterns/Manifest                      |   1 -
 dev-qt/qtxmlpatterns/qtxmlpatterns-5.14.1.ebuild   |  30 ----
 110 files changed, 2373 deletions(-)

[Comment 22 Agostino Sarubbo 2020-06-03 18:42:36 UTC]

arm stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.

[Comment 23 Andreas Sturmlechner 2020-06-03 18:44:13 UTC]

Cleanup was done already. arm was only re-added for a fix revbump.

[Comment 24 Sam James 2020-06-06 21:52:16 UTC]

(In reply to Andreas Sturmlechner from comment #23)
> Cleanup was done already. arm was only re-added for a fix revbump.

excellent, thanks!

[Comment 25 NATTkA bot 2020-06-21 22:28:42 UTC]

Unable to check for sanity:

> no match for package: dev-qt/qtdeclarative-5.14.2-r2

[Comment 26 GLSAMaker/CVETool Bot 2020-07-27 00:39:19 UTC]

This issue was resolved and addressed in
 GLSA 202007-38 at https://security.gentoo.org/glsa/202007-38
by GLSA coordinator Sam James (sam_c).