SUSE-SU-2020:1021-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2020:1021-1

MEDIUM4.0

Security update for libqt4

Published Apr 17, 2020

Modified 6 years ago

Fix available

Details

Description of the patch:

This update for libqt4 fixes the following issues:

CVE-2018-15518: Fixed a double free in QXmlStreamReader (bsc#1118595)
CVE-2018-19873: Fixed a segmantation fault via a malformed BMP file (bsc#1118596).
CVE-2018-19869: Fixed an improper checking which might lead to a crach via a malformed url reference (bsc#1118599).
Added stricter toplevel asm parsing by dropping volatile qualification that has no effect (bsc#1121214).

Affected Packages(22 packages)

libqt4

SUSE Linux Enterprise Server 12 SP4SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP4SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

4.8.7-8.13.1

libqt4-32bit

SUSE Linux Enterprise Server 12 SP4SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP4SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

4.8.7-8.13.1

libqt4-qt3support

SUSE Linux Enterprise Server 12 SP4SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP4SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

4.8.7-8.13.1

libqt4-qt3support-32bit

SUSE Linux Enterprise Server 12 SP4SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP4SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

4.8.7-8.13.1

libqt4-sql

SUSE Linux Enterprise Server 12 SP4SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP4SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

4.8.7-8.13.1

libqt4-sql-32bit

SUSE Linux Enterprise Server 12 SP4SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP4SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

4.8.7-8.13.1

libqt4-sql-mysql

SUSE Linux Enterprise Server 12 SP4SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP4SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

4.8.7-8.13.1

libqt4-sql-sqlite

SUSE Linux Enterprise Server 12 SP4SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP4SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

4.8.7-8.13.1

libqt4-x11

SUSE Linux Enterprise Server 12 SP4SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP4SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

4.8.7-8.13.1

libqt4-x11-32bit

SUSE Linux Enterprise Server 12 SP4SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP4SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

4.8.7-8.13.1

References

https://bugzilla.suse.com/1118595

https://bugzilla.suse.com/1118596

https://bugzilla.suse.com/1118599

https://bugzilla.suse.com/1121214

https://lists.suse.com/pipermail/sle-security-updates/2020-April/006715.html

https://www.suse.com/security/cve/CVE-2018-15518/

https://www.suse.com/security/cve/CVE-2018-19869/

https://www.suse.com/security/cve/CVE-2018-19873/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2020/suse-su-20201021-1/

CVSS Analysis

CVSS v3.0

4.0

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

LowA:L

4.0/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Upstream

CVE-2018-15518 CVE-2018-19869 CVE-2018-19873

Ecosystems(8)

SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP4

Timeline

PublishedApr 17, 2020

ModifiedApr 17, 2020