Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 494728 (CVE-2013-4549) - <dev-qt/qtcore-4.8.5-r1 : QXmlSimpleReader XML Entity Expansion Denial of Service Vulnerability (CVE-2013-4549)
Summary: <dev-qt/qtcore-4.8.5-r1 : QXmlSimpleReader XML Entity Expansion Denial of Ser...
Status: RESOLVED FIXED
Alias: CVE-2013-4549
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://secunia.com/advisories/56008/
Whiteboard: B3 [glsa]
Keywords:
Depends on: 491138
Blocks:
  Show dependency tree
 
Reported: 2013-12-19 10:46 UTC by Agostino Sarubbo
Modified: 2014-03-13 17:24 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-12-19 10:46:05 UTC
From ${URL} :

Description

A vulnerability has been reported in Qt, which can be exploited by malicious people to cause a DoS (Denial 
of Service) in an application using the library.

The vulnerability is caused due to an error within the QXmlSimpleReader class when parsing XML entities 
and can be exploited to e.g. exhaust resources via a specially crafted XML document including external 
entity references.

The vulnerability is reported in versions prior to 5.2.


Solution:
Update to version 5.2 or apply patches.

Provided and/or discovered by:
The vendor credits Florian Weimer, Red Hat Security Team.

Original Advisory:
http://lists.qt-project.org/pipermail/announce/2013-December/000036.html


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Sergey Popov gentoo-dev 2013-12-19 16:09:48 UTC
There is a patch, submitted in Qt's gerrit for 4.8 branch

@pesa: as i undestand we will wait for upstream approval, huh?
Comment 2 Davide Pesavento gentoo-dev 2013-12-19 17:22:18 UTC
(In reply to Sergey Popov from comment #1)
> There is a patch, submitted in Qt's gerrit for 4.8 branch
> 
> @pesa: as i undestand we will wait for upstream approval, huh?

I don't know what you're talking about. The fix for 4.8 (https://codereview.qt-project.org/71010) has already been approved and merged upstream.
Comment 3 Sergey Popov gentoo-dev 2013-12-19 17:58:42 UTC
(In reply to Davide Pesavento from comment #2)
> (In reply to Sergey Popov from comment #1)
> > There is a patch, submitted in Qt's gerrit for 4.8 branch
> > 
> > @pesa: as i undestand we will wait for upstream approval, huh?
> 
> I don't know what you're talking about. The fix for 4.8
> (https://codereview.qt-project.org/71010) has already been approved and
> merged upstream.

Meh, just get lost with Gerrit :-)
So, will we roll out new revision?
Comment 4 Davide Pesavento gentoo-dev 2013-12-19 23:20:53 UTC
I think we have to backport both cecceb0cdd87482124a73ecf537f3445d68be13e and 512a1ce0698d370c313bb561bbf078935fa0342e from the 4.8 branch
Comment 5 Davide Pesavento gentoo-dev 2013-12-28 01:26:17 UTC
*qtcore-4.8.5-r1 (28 Dec 2013)

  28 Dec 2013; Davide Pesavento <pesa@gentoo.org>
  +files/CVE-2013-4549-01-disallow-deep-or-widely-nested-entity-refs.patch,
  +files/CVE-2013-4549-02-fully-expand-entities.patch, +qtcore-4.8.5-r1.ebuild:
  Apply upstream patches for CVE-2013-4549.
Comment 6 Yury German Gentoo Infrastructure gentoo-dev 2013-12-28 06:10:01 UTC
Since build is in tree, changing whiteboard to ebuild.

Maintainer(s), please drop the vulnerable versions when you have enough testing done.
Comment 7 Yury German Gentoo Infrastructure gentoo-dev 2013-12-28 15:39:02 UTC
Sorry my mistake... should of been Maintaners please advise when ready for stabilization
Comment 8 Davide Pesavento gentoo-dev 2013-12-28 16:07:12 UTC
Ready for stabilization.

Please note that alpha/ia64/sparc have to stabilize all other 4.8.5 packages too (see bug 488536)
Comment 9 Sergey Popov gentoo-dev 2013-12-29 06:03:38 UTC
Moved all unresolved dependencies from bug #488536 to this one

Arches, please test and mark stable =dev-qt/qtcore-4.8.5-r1

Target keywords: alpha amd64 arm hppa ia64 ppc ppc64 sparc x86
Comment 10 Agostino Sarubbo gentoo-dev 2013-12-29 19:28:16 UTC
amd64 stable
Comment 11 Agostino Sarubbo gentoo-dev 2013-12-29 19:28:44 UTC
x86 stable
Comment 12 Jeroen Roovers (RETIRED) gentoo-dev 2013-12-30 03:29:27 UTC
Stable for HPPA.
Comment 13 Agostino Sarubbo gentoo-dev 2014-01-04 12:38:43 UTC
ppc stable
Comment 14 Agostino Sarubbo gentoo-dev 2014-01-04 12:40:05 UTC
ppc64 stable
Comment 15 Markus Meier gentoo-dev 2014-01-04 13:31:54 UTC
arm stable
Comment 16 Agostino Sarubbo gentoo-dev 2014-01-06 09:39:03 UTC
sparc stable
Comment 17 Agostino Sarubbo gentoo-dev 2014-01-19 13:54:10 UTC
alpha stable
Comment 18 Agostino Sarubbo gentoo-dev 2014-01-26 11:56:20 UTC
ia64 stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 19 Davide Pesavento gentoo-dev 2014-01-26 17:48:08 UTC
(In reply to Agostino Sarubbo from comment #18)
> Maintainer(s), please cleanup.

Cleanup done.
Comment 20 Sergey Popov gentoo-dev 2014-02-19 13:49:57 UTC
Thanks for your work, arches

GLSA vote: yes
Comment 21 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2014-02-19 14:50:04 UTC
GLSA vote: yes.

glsa request filed.
Comment 22 GLSAMaker/CVETool Bot gentoo-dev 2014-03-13 17:24:38 UTC
This issue was resolved and addressed in
 GLSA 201403-04 at http://security.gentoo.org/glsa/glsa-201403-04.xml
by GLSA coordinator Mikle Kolyada (Zlogene).