Bug 808531 – <dev-qt/qtgui-5.15.2-r10: Out of bounds write (CVE-2021-38593)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sam James 2021-08-16 00:34:45 UTC]

Description:
"Qt 5.0.0 through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke)."

[Comment 1 Sam James 2021-08-16 00:41:24 UTC]

Original oss-fuzz bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35566

Qt commit: https://github.com/qt/qtbase/commit/6b400e3147dcfd8cc3a393ace1bd118c93762e0c

KDE patches:
https://invent.kde.org/qt/qt/qtbase/-/commit/6b400e3147dcfd8cc3a393ace1bd118c93762e0c
then
https://invent.kde.org/qt/qt/qtbase/-/commit/84aba80944a2e1c3058d7a1372e0e66676411884

[Comment 2 Andreas Sturmlechner 2021-08-21 11:38:33 UTC]

Also depends on:

https://invent.kde.org/qt/backports-tracker/-/issues/259

[Comment 3 Andreas Sturmlechner 2021-08-22 21:37:27 UTC]

Patches merged upstream.

[Comment 4 Larry the Git Cow 2021-08-25 14:36:38 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f01973dc8dbe0b64096e2467f9063976700e1884

commit f01973dc8dbe0b64096e2467f9063976700e1884
Author:     Andreas Sturmlechner <[e-mail]>
AuthorDate: 2021-08-15 22:27:19 +0000
Commit:     Andreas Sturmlechner <[e-mail]>
CommitDate: 2021-08-25 14:35:48 +0000

    dev-qt/qtgui: 5.15.2-r10 version bump at KDE c2ea67ec
    
    - EAPI-8
    - Fix CVE-2021-38593
    
    See also:
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35566
    https://invent.kde.org/qt/qt/qtbase/-/merge_requests/47
    
    Bug: https://bugs.gentoo.org/808531
    Closes: https://bugs.gentoo.org/807871
    Package-Manager: Portage-3.0.22, Repoman-3.0.3
    Signed-off-by: Andreas Sturmlechner <[e-mail]>

 dev-qt/qtgui/Manifest                |   1 +
 dev-qt/qtgui/qtgui-5.15.2-r10.ebuild | 185 +++++++++++++++++++++++++++++++++++
 2 files changed, 186 insertions(+)

[Comment 5 John Helmert III 2021-10-17 00:33:25 UTC]

Please cleanup

[Comment 6 Larry the Git Cow 2021-10-17 00:44:04 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b8fe578396ad2fa99ec407cc27cada67d85217b9

commit b8fe578396ad2fa99ec407cc27cada67d85217b9
Author:     Andreas Sturmlechner <[e-mail]>
AuthorDate: 2021-10-17 00:37:32 +0000
Commit:     Andreas Sturmlechner <[e-mail]>
CommitDate: 2021-10-17 00:40:25 +0000

    dev-qt/qtgui: Drop vulnerable 5.15.2-r2
    
    Bug: https://bugs.gentoo.org/808531
    Package-Manager: Portage-3.0.28, Repoman-3.0.3
    Signed-off-by: Andreas Sturmlechner <[e-mail]>

 dev-qt/qtgui/Manifest                              |   2 -
 .../files/qtgui-5.15.2-bogus-xcb-util-dep.patch    |  72 --------
 dev-qt/qtgui/qtgui-5.15.2-r2.ebuild                | 190 ---------------------
 3 files changed, 264 deletions(-)

[Comment 7 Andreas Sturmlechner 2022-04-19 20:01:28 UTC]

This cleanup happened, btw.

[Comment 8 John Helmert III 2022-04-20 14:12:14 UTC]

(In reply to Andreas Sturmlechner from comment #7)
> This cleanup happened, btw.

Yes, that's why 'cleanup' is no longer in the whiteboard

[Comment 9 Larry the Git Cow 2024-02-03 06:23:30 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=bf99e106687f9b6e6a78ef119c0842d716e4bf86

commit bf99e106687f9b6e6a78ef119c0842d716e4bf86
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-02-03 06:19:26 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2024-02-03 06:23:18 +0000

    [ GLSA 202402-03 ] QtGui: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/808531
    Bug: https://bugs.gentoo.org/907119
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202402-03.xml | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)