CVE-2020-13962

Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1 is not affected, regardless of the Qt version.)

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.

Security Fix(es):

• qt: XML entity expansion vulnerability (CVE-2015-9541)

• qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore attacker can cause DOS (CVE-2018-21035)

• qt: files placed by attacker can influence the working directory and lead to malicious code execution (CVE-2020-0569)

• qt: files placed by attacker can influence the working directory and lead to malicious code execution (CVE-2020-0570)

• qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS applications (CVE-2020-13962)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1 is not affected, regardless of the Qt version.)

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.

Security Fix(es):

• qt: XML entity expansion vulnerability (CVE-2015-9541)

• qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore attacker can cause DOS (CVE-2018-21035)

• qt: files placed by attacker can influence the working directory and lead to malicious code execution (CVE-2020-0569)

• qt: files placed by attacker can influence the working directory and lead to malicious code execution (CVE-2020-0570)

• qt5: incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS applications (CVE-2020-13962)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

QSslSocket incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS applications (CVE-2020-13962)

This update provides additionals fixes:

• Check that the sizes are even representable when checking if clipping is necessary (P300)

• Multiply instead of shifting, The shift operator is undefined for negative values. (P301)

• Check returns of hex2int in get_hex_rgb, Avoids undefined behavior when trying to shift negative values. (P302)

• Sanitize lengthValue in CSS parser, Limit the LengthData to the integer range before rounding it, taking into account that qRound() substracts 1 from negative values. (P303)

• QBezier: Don't try calculating a unit vector when length is null. It's undefined and causes a division by zero. (P304)

• Avoid potential ub in corrupt bmp file. biHeight may be int_min, in which case qAbs<int>() will not work. (P305)

• wasm: disable XDG_RUNTIME_DIR warning XDG is not very relevant on the Web platform. (P306)

• Use SOURCE_DATE_EPOCH. Use the standard variable name in addition to the QT-specific one to make builds reproducible out-of-the-box (P308)

• Fix notification of QDockWidget when it gets undocked (P309)

• Synthesize Enter/LeaveEvent for accepted QTabletEvent (P310)

• Fix crash when running QtCore: Stack is misaligned on x86-64 (P311)

• Add support for PostgreSQL 12 (P312)

• QStandardPaths: Correct handling for XDG_RUNTIME_DIR (P313)

• QStandardPaths/Unix: improve the XDG_RUNTIME_DIR creation/detection (P312)

• Add remote print queue support (P313)

This update for libqt5-qtbase fixes the following issues:

• Fixed a possible crash in certificate parsing.
• Fixed a DoS in QSslSocket (bsc#1172726, CVE-2020-13962).
• Added support for PostgreSQL 12 (bsc#1173758).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the libQt5Bootstrap-devel-static-32bit-5.15.2+kde268-2.1 package on the GA media of openSUSE Tumbleweed.

This update for libqt5-qtbase fixes the following issues:

• Fixed a possible crash in certificate parsing.
• Fixed a DoS in QSslSocket (bsc#1172726, CVE-2020-13962).
• Added support for PostgreSQL 12 (bsc#1173758).

It was discovered that Qt did not correctly handle OpenSSL's error queue. An attacker could possibly use this issue to cause a denial of service. This issue was only addressed in Ubuntu 20.04 LTS. (CVE-2020-13962)

It was discovered that Qt incorrectly handled certain XBM image files. If a user or automated system were tricked into opening a specially crafted PPM file, a remote attacker could cause Qt to crash, resulting in a denial of service. This issue was only addressed in Ubuntu 16.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-17507)

It was discovered that Qt did not correctly handle executing specific binaries. If a user or automated system were tricked into executing a binary at a specific file path, an attacker could cause a denial of service or execute arbitrary code. This issue was only addressed in Ubuntu 20.04 LTS. (CVE-2022-25255)

It was discovered that Qt did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service. This issue was only addressed in Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-51714)

It was discovered that Qt did not correctly handle certain encrypted connections. An attacker could possibly use this issue to leak sensitive information. This issue was only addressed in Ubuntu 24.04 LTS. (CVE-2024-39936)