Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 719732 (CVE-2020-12267, qt-5.14.2-stable) - <dev-qt/qtgui-5.14.2: Use-after-free in QTextMarkdownImporter (CVE-2020-12267)
Summary: <dev-qt/qtgui-5.14.2: Use-after-free in QTextMarkdownImporter (CVE-2020-12267)
Status: RESOLVED FIXED
Alias: CVE-2020-12267, qt-5.14.2-stable
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: A3 [glsa+ cve]
Keywords:
: 718754 (view as bug list)
Depends on:
Blocks: icu-67.1-stable 721452
  Show dependency tree
 
Reported: 2020-04-27 04:51 UTC by GLSAMaker/CVETool Bot
Modified: 2020-07-27 00:39 UTC (History)
2 users (show)

See Also:
Package list:
dev-qt/assistant-5.14.2 amd64 arm64 x86 dev-qt/designer-5.14.2 amd64 arm64 ppc x86 dev-qt/linguist-5.14.2 amd64 arm64 x86 dev-qt/linguist-tools-5.14.2 amd64 arm64 ppc x86 dev-qt/pixeltool-5.14.2 amd64 arm64 x86 dev-qt/qdbus-5.14.2 amd64 arm64 ppc x86 dev-qt/qdbusviewer-5.14.2 amd64 arm64 x86 dev-qt/qdoc-5.14.2 amd64 arm64 x86 dev-qt/qt3d-5.14.2 amd64 arm64 x86 dev-qt/qtbluetooth-5.14.2 amd64 arm64 x86 dev-qt/qtcharts-5.14.2 amd64 arm64 x86 dev-qt/qtconcurrent-5.14.2 amd64 arm64 ppc x86 dev-qt/qtcore-5.14.2 amd64 arm64 ppc x86 dev-qt/qtdatavis3d-5.14.2 amd64 arm64 x86 dev-qt/qtdbus-5.14.2 amd64 arm64 ppc x86 dev-qt/qtdeclarative-5.14.2-r2 amd64 arm arm64 ppc ppc64 x86 dev-qt/qtdiag-5.14.2 amd64 x86 dev-qt/qt-docs-5.14.2_p202003291239 amd64 arm64 x86 dev-qt/qtgamepad-5.14.2 amd64 arm64 x86 dev-qt/qtgraphicaleffects-5.14.2 amd64 arm64 ppc x86 dev-qt/qtgui-5.14.2 amd64 arm64 ppc x86 dev-qt/qthelp-5.14.2 amd64 arm64 ppc x86 dev-qt/qtimageformats-5.14.2 amd64 arm64 x86 dev-qt/qtlocation-5.14.2 amd64 arm64 x86 dev-qt/qtmultimedia-5.14.2 amd64 arm64 ppc x86 dev-qt/qtnetwork-5.14.2 amd64 arm64 ppc x86 dev-qt/qtnetworkauth-5.14.2 amd64 arm64 x86 dev-qt/qtopengl-5.14.2 amd64 arm64 ppc x86 dev-qt/qtpaths-5.14.2 amd64 arm64 ppc x86 dev-qt/qtpositioning-5.14.2 amd64 arm64 ppc x86 dev-qt/qtprintsupport-5.14.2 amd64 arm64 ppc x86 dev-qt/qtquickcontrols2-5.14.2 amd64 arm64 x86 dev-qt/qtquickcontrols-5.14.2 amd64 arm64 ppc x86 dev-qt/qtscript-5.14.2 amd64 arm64 ppc x86 dev-qt/qtscxml-5.14.2 amd64 arm64 x86 dev-qt/qtsensors-5.14.2 amd64 arm64 x86 dev-qt/qtserialport-5.14.2 amd64 arm64 ppc x86 dev-qt/qtspeech-5.14.2 amd64 arm64 x86 dev-qt/qtsql-5.14.2 amd64 arm64 ppc x86 dev-qt/qtsvg-5.14.2 amd64 arm64 ppc x86 dev-qt/qttest-5.14.2 amd64 arm64 ppc x86 dev-qt/qttranslations-5.14.2 amd64 arm64 ppc x86 dev-qt/qtvirtualkeyboard-5.14.2 amd64 arm64 x86 dev-qt/qtwayland-5.14.2 amd64 arm64 ppc x86 dev-qt/qtwebchannel-5.14.2 amd64 arm64 x86 dev-qt/qtwebengine-5.14.2 amd64 arm64 x86 dev-qt/qtwebsockets-5.14.2 amd64 arm64 x86 dev-qt/qtwidgets-5.14.2 amd64 arm64 ppc x86 dev-qt/qtx11extras-5.14.2 amd64 arm64 ppc x86 dev-qt/qtxml-5.14.2 amd64 arm64 ppc x86 dev-qt/qtxmlpatterns-5.14.2 amd64 arm64 ppc x86 kde-apps/dolphin-19.12.3-r1 amd64 arm64 x86
Runtime testing required: ---
nattka: sanity-check-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2020-04-27 04:51:21 UTC
CVE-2020-12267 (https://nvd.nist.gov/vuln/detail/CVE-2020-12267):
  setMarkdown in Qt before 5.14.2 has a use-after-free related to
  QTextMarkdownImporter::insertBlock.
Comment 1 Andreas Sturmlechner gentoo-dev 2020-04-28 20:53:29 UTC
*** Bug 716992 has been marked as a duplicate of this bug. ***
Comment 2 Andreas Sturmlechner gentoo-dev 2020-04-28 21:09:48 UTC
First-time stabilisations:

dev-qt/qtdiag-5.14.2 amd64 x86 (see bug 718754)
dev-qt/qtcharts-5.14.2 amd64 arm64 x86 (for kuserfeedback, used by plasma-workspace)

Any objections?
Comment 3 Davide Pesavento gentoo-dev 2020-04-28 21:14:01 UTC
(In reply to Andreas Sturmlechner from comment #2)
> First-time stabilisations:
> 
> dev-qt/qtdiag-5.14.2 amd64 x86 (see bug 718754)
> dev-qt/qtcharts-5.14.2 amd64 arm64 x86 (for kuserfeedback, used by
> plasma-workspace)
> 
> Any objections?
Sounds good to me.
Comment 4 Andreas Sturmlechner gentoo-dev 2020-04-29 10:10:38 UTC
Reason for the regression with horizontal scrollbars appearing when they shouldn't (https://bugs.kde.org/show_bug.cgi?id=419514) was identified as commit a82b1b27 in qtdeclarative, that is still to be fixed before we add arches.
Comment 5 Andreas Sturmlechner gentoo-dev 2020-05-07 08:54:32 UTC
Adding arm and ppc64 ahead of the pack, no stable keyword on qtwebengine so no coordination required.
Comment 6 NATTkA bot gentoo-dev 2020-05-07 08:57:14 UTC
Sanity check failed:

> dev-qt/qtwebview-5.14.2
>   depend arm stable profile default/linux/arm/17.0 (19 total)
>     ~dev-qt/qtwebengine-5.14.2
>   depend arm dev profile default/linux/arm/17.0/armv4 (35 total)
>     ~dev-qt/qtwebengine-5.14.2
>   rdepend arm stable profile default/linux/arm/17.0 (19 total)
>     ~dev-qt/qtwebengine-5.14.2
>   rdepend arm dev profile default/linux/arm/17.0/armv4 (35 total)
>     ~dev-qt/qtwebengine-5.14.2
Comment 7 Andreas Sturmlechner gentoo-dev 2020-05-07 09:12:33 UTC
Cleanup some stray entries that should not be in package list.
Comment 8 NATTkA bot gentoo-dev 2020-05-07 09:17:15 UTC
All sanity-check issues have been resolved
Comment 9 Andreas Sturmlechner gentoo-dev 2020-05-07 11:30:15 UTC
Adding kde-apps/dolphin-19.12.3-r1 which has a fix specifically for Qt 5.14.2, commit 99ec5f37.
Comment 10 Agostino Sarubbo gentoo-dev 2020-05-09 07:44:12 UTC
arm stable
Comment 11 Agostino Sarubbo gentoo-dev 2020-05-09 07:47:15 UTC
ppc64 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 12 Andreas Sturmlechner gentoo-dev 2020-05-09 07:48:31 UTC
Thanks ago, but other arches are not there yet. ;)
Comment 13 Andreas Sturmlechner gentoo-dev 2020-05-09 08:40:06 UTC
*** Bug 718754 has been marked as a duplicate of this bug. ***
Comment 14 Andreas Sturmlechner gentoo-dev 2020-05-17 00:29:55 UTC
Bumping dev-qt/qtdeclarative-5.14.2-r1 for a UI fix.
Comment 15 Andreas Sturmlechner gentoo-dev 2020-05-19 19:20:22 UTC
Arches please stabilise. If at all possible, please stabilise at the same time with:
bug 720172
bug 723414
bug 716822
bug 723404
Comment 16 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2020-05-19 19:31:53 UTC
amd64 stable
Comment 17 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2020-05-20 09:50:21 UTC
x86 stable
Comment 18 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2020-05-20 13:31:52 UTC
arm64 stable
Comment 19 Sergei Trofimovich gentoo-dev 2020-05-22 08:19:08 UTC
ppc64 stable
Comment 20 Sergei Trofimovich gentoo-dev 2020-05-30 19:54:21 UTC
ppc stable
Comment 21 Larry the Git Cow gentoo-dev 2020-05-30 20:58:03 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bc400dc11d5dae40db820619210e49adff1f4306

commit bc400dc11d5dae40db820619210e49adff1f4306
Author:     Andreas Sturmlechner <asturm@gentoo.org>
AuthorDate: 2020-05-30 20:06:48 +0000
Commit:     Andreas Sturmlechner <asturm@gentoo.org>
CommitDate: 2020-05-30 20:46:00 +0000

    dev-qt: Drop Qt 5.14.1 and vulnerable dev-qt/qtgui
    
    Bug: https://bugs.gentoo.org/719732
    Package-Manager: Portage-2.3.100, Repoman-2.3.22
    Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org>

 dev-qt/assistant/Manifest                          |   1 -
 dev-qt/assistant/assistant-5.14.1.ebuild           |  55 ------
 dev-qt/designer/Manifest                           |   1 -
 dev-qt/designer/designer-5.14.1.ebuild             |  57 -------
 dev-qt/linguist-tools/Manifest                     |   1 -
 dev-qt/linguist-tools/linguist-tools-5.14.1.ebuild |  35 ----
 dev-qt/linguist/Manifest                           |   1 -
 dev-qt/linguist/linguist-5.14.1.ebuild             |  48 ------
 dev-qt/pixeltool/Manifest                          |   1 -
 dev-qt/pixeltool/pixeltool-5.14.1.ebuild           |  25 ---
 dev-qt/qdbus/Manifest                              |   1 -
 dev-qt/qdbus/qdbus-5.14.1.ebuild                   |  25 ---
 dev-qt/qdbusviewer/Manifest                        |   1 -
 dev-qt/qdbusviewer/qdbusviewer-5.14.1.ebuild       |  45 -----
 dev-qt/qdoc/Manifest                               |   1 -
 dev-qt/qdoc/qdoc-5.14.1.ebuild                     |  40 -----
 dev-qt/qt-docs/Manifest                            |  54 ------
 dev-qt/qt-docs/qt-docs-5.14.1_p202001241012.ebuild |  89 ----------
 dev-qt/qt3d/Manifest                               |   1 -
 dev-qt/qt3d/qt3d-5.14.1-r1.ebuild                  |  34 ----
 dev-qt/qtbluetooth/Manifest                        |   1 -
 .../files/qtbluetooth-5.14.1-errno.patch           |  25 ---
 dev-qt/qtbluetooth/qtbluetooth-5.14.1.ebuild       |  35 ----
 dev-qt/qtcharts/Manifest                           |   1 -
 dev-qt/qtcharts/qtcharts-5.14.1.ebuild             |  29 ----
 dev-qt/qtconcurrent/Manifest                       |   1 -
 dev-qt/qtconcurrent/qtconcurrent-5.14.1.ebuild     |  23 ---
 dev-qt/qtcore/Manifest                             |   1 -
 dev-qt/qtcore/qtcore-5.14.1-r1.ebuild              |  85 ----------
 dev-qt/qtdatavis3d/Manifest                        |   1 -
 dev-qt/qtdatavis3d/qtdatavis3d-5.14.1-r1.ebuild    |  31 ----
 dev-qt/qtdbus/Manifest                             |   1 -
 dev-qt/qtdbus/qtdbus-5.14.1.ebuild                 |  43 -----
 dev-qt/qtdeclarative/Manifest                      |   1 -
 .../qtdeclarative/qtdeclarative-5.14.1-r2.ebuild   |  53 ------
 dev-qt/qtdiag/Manifest                             |   1 -
 dev-qt/qtdiag/qtdiag-5.14.1.ebuild                 |  36 ----
 dev-qt/qtgamepad/Manifest                          |   1 -
 dev-qt/qtgamepad/qtgamepad-5.14.1.ebuild           |  35 ----
 dev-qt/qtgraphicaleffects/Manifest                 |   1 -
 .../qtgraphicaleffects-5.14.1.ebuild               |  21 ---
 dev-qt/qtgui/Manifest                              |   1 -
 dev-qt/qtgui/qtgui-5.14.1-r4.ebuild                | 184 ---------------------
 dev-qt/qthelp/Manifest                             |   1 -
 dev-qt/qthelp/qthelp-5.14.1.ebuild                 |  29 ----
 dev-qt/qtimageformats/Manifest                     |   1 -
 dev-qt/qtimageformats/qtimageformats-5.14.1.ebuild |  30 ----
 dev-qt/qtlocation/Manifest                         |   1 -
 dev-qt/qtlocation/qtlocation-5.14.1.ebuild         |  45 -----
 dev-qt/qtmultimedia/Manifest                       |   1 -
 dev-qt/qtmultimedia/qtmultimedia-5.14.1-r1.ebuild  |  68 --------
 dev-qt/qtnetwork/Manifest                          |   1 -
 dev-qt/qtnetwork/qtnetwork-5.14.1.ebuild           |  60 -------
 dev-qt/qtnetworkauth/Manifest                      |   1 -
 dev-qt/qtnetworkauth/qtnetworkauth-5.14.1.ebuild   |  20 ---
 dev-qt/qtopengl/Manifest                           |   1 -
 dev-qt/qtopengl/qtopengl-5.14.1-r1.ebuild          |  34 ----
 dev-qt/qtpaths/Manifest                            |   1 -
 dev-qt/qtpaths/qtpaths-5.14.1.ebuild               |  23 ---
 dev-qt/qtplugininfo/Manifest                       |   1 -
 dev-qt/qtplugininfo/qtplugininfo-5.14.1.ebuild     |  23 ---
 dev-qt/qtpositioning/Manifest                      |   1 -
 dev-qt/qtpositioning/qtpositioning-5.14.1.ebuild   |  40 -----
 dev-qt/qtprintsupport/Manifest                     |   1 -
 .../qtprintsupport/qtprintsupport-5.14.1-r1.ebuild |  42 -----
 dev-qt/qtquickcontrols/Manifest                    |   1 -
 .../qtquickcontrols/qtquickcontrols-5.14.1.ebuild  |  32 ----
 dev-qt/qtquickcontrols2/Manifest                   |   1 -
 .../qtquickcontrols2-5.14.1.ebuild                 |  30 ----
 dev-qt/qtscript/Manifest                           |   1 -
 dev-qt/qtscript/qtscript-5.14.1.ebuild             |  36 ----
 dev-qt/qtscxml/Manifest                            |   1 -
 dev-qt/qtscxml/qtscxml-5.14.1.ebuild               |  19 ---
 dev-qt/qtsensors/Manifest                          |   1 -
 dev-qt/qtsensors/qtsensors-5.14.1.ebuild           |  28 ----
 dev-qt/qtserialbus/Manifest                        |   1 -
 dev-qt/qtserialbus/qtserialbus-5.14.1.ebuild       |  20 ---
 dev-qt/qtserialport/Manifest                       |   1 -
 dev-qt/qtserialport/qtserialport-5.14.1.ebuild     |  27 ---
 dev-qt/qtspeech/Manifest                           |   1 -
 dev-qt/qtspeech/qtspeech-5.14.1.ebuild             |  20 ---
 dev-qt/qtsql/Manifest                              |   1 -
 dev-qt/qtsql/qtsql-5.14.1.ebuild                   |  55 ------
 dev-qt/qtsvg/Manifest                              |   1 -
 dev-qt/qtsvg/qtsvg-5.14.1.ebuild                   |  23 ---
 dev-qt/qttest/Manifest                             |   1 -
 dev-qt/qttest/qttest-5.14.1.ebuild                 |  33 ----
 dev-qt/qttranslations/Manifest                     |   1 -
 dev-qt/qttranslations/qttranslations-5.14.1.ebuild |  19 ---
 dev-qt/qtvirtualkeyboard/Manifest                  |   1 -
 .../qtvirtualkeyboard-5.14.1.ebuild                |  43 -----
 dev-qt/qtwayland/Manifest                          |   1 -
 dev-qt/qtwayland/qtwayland-5.14.1-r3.ebuild        |  45 -----
 dev-qt/qtwebchannel/Manifest                       |   1 -
 dev-qt/qtwebchannel/qtwebchannel-5.14.1.ebuild     |  26 ---
 dev-qt/qtwebengine/Manifest                        |   1 -
 .../qtwebengine-5.14.1-detect-ninja-1.10.patch     |  27 ---
 dev-qt/qtwebengine/qtwebengine-5.14.1.ebuild       | 130 ---------------
 dev-qt/qtwebsockets/Manifest                       |   1 -
 dev-qt/qtwebsockets/qtwebsockets-5.14.1.ebuild     |  27 ---
 dev-qt/qtwebview/Manifest                          |   1 -
 dev-qt/qtwebview/qtwebview-5.14.1.ebuild           |  21 ---
 dev-qt/qtwidgets/Manifest                          |   1 -
 dev-qt/qtwidgets/qtwidgets-5.14.1-r1.ebuild        |  57 -------
 dev-qt/qtx11extras/Manifest                        |   1 -
 dev-qt/qtx11extras/qtx11extras-5.14.1.ebuild       |  22 ---
 dev-qt/qtxml/Manifest                              |   1 -
 dev-qt/qtxml/qtxml-5.14.1.ebuild                   |  29 ----
 dev-qt/qtxmlpatterns/Manifest                      |   1 -
 dev-qt/qtxmlpatterns/qtxmlpatterns-5.14.1.ebuild   |  30 ----
 110 files changed, 2373 deletions(-)
Comment 22 Agostino Sarubbo gentoo-dev 2020-06-03 18:42:36 UTC
arm stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 23 Andreas Sturmlechner gentoo-dev 2020-06-03 18:44:13 UTC
Cleanup was done already. arm was only re-added for a fix revbump.
Comment 24 Sam James archtester gentoo-dev Security 2020-06-06 21:52:16 UTC
(In reply to Andreas Sturmlechner from comment #23)
> Cleanup was done already. arm was only re-added for a fix revbump.

excellent, thanks!
Comment 25 NATTkA bot gentoo-dev 2020-06-21 22:28:42 UTC
Unable to check for sanity:

> no match for package: dev-qt/qtdeclarative-5.14.2-r2
Comment 26 GLSAMaker/CVETool Bot gentoo-dev 2020-07-27 00:39:19 UTC
This issue was resolved and addressed in
 GLSA 202007-38 at https://security.gentoo.org/glsa/202007-38
by GLSA coordinator Sam James (sam_c).