{"id":"CVE-2015-1859","aliases":["DEBIAN-CVE-2015-1859","DLA-210-1","EUVD-2015-1967","GHSA-wj8c-4f82-jfpp","MGASA-2015-0198","SUSE-SU-2015:0977-1","SUSE-SU-2015:1359-1","SUSE-SU-2015:1383-1","UBUNTU-CVE-2015-1859","USN-2626-1","openSUSE-SU-2024:10180-1"],"status":"published","title":"Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt...","description":"Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.06542,"percentile":0.9385,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2015-04-29T00:00:00Z","modified":"2026-09-09T06:47:33Z","fixes":[{"ecosystem":"Debian:12","package":"qtbase-opensource-src","fixed_in":["5.3.2+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qtbase-opensource-src","fixed_in":["5.3.2+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qtbase-opensource-src","fixed_in":["5.3.2+dfsg-5"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qt4-x11","fixed_in":["4:4.8.5+git192-g085f851+dfsg-2ubuntu4.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qtbase-opensource-src","fixed_in":["5.2.1+dfsg-1ubuntu14.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.2+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.2+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.2+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"qt4-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.3-4+squeeze3"}]}],"versions":["4:4.6.3-4","4:4.6.3-4+squeeze1","4:4.6.3-4+squeeze2"],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"qt3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8b-33.4.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"qt4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-1.3.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"qtbase5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-2.5.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"libqt4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"libqt4-sql-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"libqt4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"libqt4-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"libqt4-sql-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"libqt4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"libqt4-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"libqt4-sql-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libqt4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libqt4-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libqt4-sql-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"libqt4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"libqt4-sql-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-4.4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-4.4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-4.4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-4.4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qt4-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.8.5+git192-g085f851+dfsg-2ubuntu4.1"}]}],"versions":["4:4.8.4+dfsg-0ubuntu18","4:4.8.4+dfsg-0ubuntu19","4:4.8.4+dfsg-0ubuntu20","4:4.8.4+dfsg-0ubuntu21","4:4.8.4+dfsg-0ubuntu22","4:4.8.5+git192-g085f851+dfsg-2ubuntu3","4:4.8.5+git192-g085f851+dfsg-2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1+dfsg-1ubuntu14.3"}]}],"versions":["5.0.2+dfsg1-7ubuntu11","5.0.2+dfsg1-7ubuntu12","5.0.2+dfsg1-7ubuntu13","5.0.2+dfsg1-7ubuntu14","5.0.2+dfsg1-7ubuntu15","5.0.2+dfsg1-7ubuntu16","5.0.2+dfsg1-7ubuntu17","5.0.2+dfsg1-7ubuntu18","5.2.1+dfsg-1ubuntu7","5.2.1+dfsg-1ubuntu8","5.2.1+dfsg-1ubuntu9","5.2.1+dfsg-1ubuntu10","5.2.1+dfsg-1ubuntu11","5.2.1+dfsg-1ubuntu13","5.2.1+dfsg-1ubuntu14","5.2.1+dfsg-1ubuntu14.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qt4-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.8.5+git192-g085f851+dfsg-2ubuntu4.1"}]}],"versions":["4:4.8.4+dfsg-0ubuntu18","4:4.8.4+dfsg-0ubuntu19","4:4.8.4+dfsg-0ubuntu20","4:4.8.4+dfsg-0ubuntu21","4:4.8.4+dfsg-0ubuntu22","4:4.8.5+git192-g085f851+dfsg-2ubuntu3","4:4.8.5+git192-g085f851+dfsg-2ubuntu4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1+dfsg-1ubuntu14.3"}]}],"versions":["5.0.2+dfsg1-7ubuntu11","5.0.2+dfsg1-7ubuntu12","5.0.2+dfsg1-7ubuntu13","5.0.2+dfsg1-7ubuntu14","5.0.2+dfsg1-7ubuntu15","5.0.2+dfsg1-7ubuntu16","5.0.2+dfsg1-7ubuntu17","5.0.2+dfsg1-7ubuntu18","5.2.1+dfsg-1ubuntu7","5.2.1+dfsg-1ubuntu8","5.2.1+dfsg-1ubuntu9","5.2.1+dfsg-1ubuntu10","5.2.1+dfsg-1ubuntu11","5.2.1+dfsg-1ubuntu13","5.2.1+dfsg-1ubuntu14","5.2.1+dfsg-1ubuntu14.2"],"bundled":5}],"products":[{"vendor":"digia","product":"qt"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"qt","product":"qt"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155424.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/74307","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155927.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://www.securityfocus.com/bid/74310","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201603-10","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155962.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155976.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2626-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://lists.qt-project.org/pipermail/announce/2015-April/000067.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","advisory","fix","web","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156727.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1859"},{"url":"https://github.com/advisories/GHSA-wj8c-4f82-jfpp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-1859","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0198.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15750","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2015-April/155424.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2015-April/155927.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150977-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/921999","tags":["report"]},{"url":"https://bugzilla.suse.com/927806","tags":["report"]},{"url":"https://bugzilla.suse.com/927807","tags":["report"]},{"url":"https://bugzilla.suse.com/927808","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1860","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151359-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/847880","tags":["report"]},{"url":"https://bugzilla.suse.com/929688","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151383-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/870151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1859","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2626-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-0295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1860","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0190","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-1859","description":"Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.","status":"published","published":"2015-05-12T19:00:00Z","modified":"2024-08-06T04:54:16.334Z","updated_at":"2026-11-02T14:35:43.698357Z"}],"euvd":[{"id":"EUVD-2015-1967","description":"Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.","status":"published","published":"2015-05-12T19:00:00Z","modified":"2024-08-06T04:54:16Z","updated_at":"2026-11-03T02:22:14.212001Z"}],"ghsa":[{"id":"GHSA-wj8c-4f82-jfpp","title":"Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt...","description":"Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.","status":"published","published":"2022-05-13T01:09:18Z","modified":"2023-02-01T05:03:31Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:50:03.88435Z"}],"nvd":[{"id":"CVE-2015-1859","description":"Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.","status":"published","published":"2015-05-12T19:59:05.957Z","modified":"2026-06-17T00:23:07.74Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:04.095849Z"}],"osv":[{"id":"CVE-2015-1859","description":"Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.","status":"published","published":"2015-05-12T19:59:05Z","modified":"2026-04-16T06:16:59.18053191Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-1859","description":"Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.","status":"published","published":"2015-05-12T19:59:05.957Z","modified":"2026-09-09T06:47:33.211765612Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DLA-210-1","title":"qt4-x11 - security update","status":"published","published":"2015-04-29T00:00:00Z","modified":"2026-03-09T01:18:59.50687Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2015-0198","title":"Updated qt3 qt4 \u0026 qtbase5 packages fix security vulnerabilities","description":"Updated qt3, qt4, and qtbase5 packages fix security vulnerabilities:\n\nIt is possible to construct invalid BMP (CVE-2015-1858), ICO (CVE-2015-1859)\nand GIF (CVE-2015-1860) images that lead to buffer overflows.\n\nQt3 is only vulnerable to the CVE-2015-1860 issue with GIF images.\n","status":"published","published":"2015-05-06T16:44:10Z","modified":"2026-04-16T06:26:03.506107653Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10180-1","title":"libqt4-32bit-4.8.7-5.4 on GA media","description":"These are all security issues fixed in the libqt4-32bit-4.8.7-5.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:34:43.783361Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2015:0977-1","title":"Security update for libqt4","description":"\nThe libqt4 library was updated to fix several security issues:\n\n    * CVE-2015-0295: Division by zero when processing malformed BMP files.\n      (bsc#921999)\n    * CVE-2015-1858: Segmentation fault in BMP Qt Image Format Handling.\n      (bsc#927806)\n    * CVE-2015-1859: Segmentation fault in ICO Qt Image Format Handling.\n      (bsc#927807)\n    * CVE-2015-1860: Segmentation fault in GIF Qt Image Format Handling.\n      (bsc#927808)\n\nSecurity Issues:\n\n    * CVE-2015-1858\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1858\u003e\n    * CVE-2015-1859\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1859\u003e\n    * CVE-2015-1860\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1860\u003e\n    * CVE-2015-0295\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0295\u003e\n\n","status":"published","published":"2015-05-12T16:07:43Z","modified":"2025-05-02T04:04:20.963533Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1359-1","title":"Security update for libqt4","description":"The libqt4 library was updated to fix several security and non security issues.\n\nThe following vulnerabilities were fixed:\n- bsc#921999: CVE-2015-0295: division by zero when processing malformed BMP files\n- bsc#927806: CVE-2015-1858: segmentation fault in BMP Qt Image Format Handling\n- bsc#927807: CVE-2015-1859: segmentation fault in ICO Qt Image Format Handling\n- bsc#927808: CVE-2015-1860: segmentation fault in GIF Qt Image Format Handling\n\nThe following non-secuirty issues were fixed:\n- bsc#929688: Critical Problem in Qt Network Stack\n- bsc#847880: kde/qt rendering error in qemu cirrus i586\n- Update use-freetype-default.diff to use same method as with\n  libqt5-qtbase package: Qt itself already does runtime check\n  whether subpixel rendering is available, but only when\n  FT_CONFIG_OPTION_SUBPIXEL_RENDERING is defined. Thus it is enough\n  to only remove that condition\n- The -devel subpackage requires Mesa-devel, not only at build time \n- Fixed compilation on SLE_11_SP3 by making it build against\n  Mesa-devel on that system\n- Replace patch l-qclipboard_fix_recursive.patch with\n  qtcore-4.8.5-qeventdispatcher-recursive.patch. The later one \n  seems to work better and really resolves the issue in LibreOffice\n- Added kde4_qt_plugin_path.patch, so kde4 plugins are magically\n  found/known outside kde4 enviroment/session\n- added _constraints. building took up to 7GB of disk space on\n  s390x, and more than 6GB on x86_64 \n- Add 3 patches for Qt bugs to make LibreOffice KDE4 file\n  picker work properly again:\n  * Add glib-honor-ExcludeSocketNotifiers-flag.diff (QTBUG-37380)\n  * Add l-qclipboard_fix_recursive.patch (QTBUG-34614)\n  * Add l-qclipboard_delay.patch (QTBUG-38585)","status":"published","published":"2015-05-27T13:53:24Z","modified":"2026-02-04T03:29:43.341614Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:1383-1","title":"Security update for libqt5-qtbase","description":"\nThis security update fixes the following issues:\n\n * Add libqt5-Fix-a-division-by-zero-processing-malformed-BMP.patch\n   - QTBUG-44547, bsc#921999 (CVE-2015-0295)\n * Add libqt5-Fixes-crash-in-bmp-and-ico-image-decoding.patch\n   - bsc#927806 (CVE-2015-1858), bsc#927807 (CVE-2015-1859)\n * Add libqt5-Fixes-crash-in-gif-image-decoder.patch\n   - bsc#927808 (CVE-2015-1860)\n * Add libqt5-fix-use-after-free-bug.patch from upstream\n   - fixes the use-after-free bug in backingstore, boo#870151\n","status":"published","published":"2015-05-29T17:35:18Z","modified":"2026-02-04T04:20:02.105032Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2015-1859","description":"Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.","status":"published","published":"2015-05-12T00:00:00Z","modified":"2026-04-22T10:03:41.387422Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2626-1","title":"qt4-x11, qtbase-opensource-src vulnerabilities","description":"Wolfgang Schenk discovered that Qt incorrectly handled certain malformed\nGIF images. If a user or automated system were tricked into opening a\nspecially crafted GIF image, a remote attacker could use this issue to\ncause Qt to crash, resulting in a denial of service. This issue only\napplied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-0190)\n\nFabian Vogt discovered that Qt incorrectly handled certain malformed BMP\nimages. If a user or automated system were tricked into opening a specially\ncrafted BMP image, a remote attacker could use this issue to cause Qt to\ncrash, resulting in a denial of service. (CVE-2015-0295)\n\nRichard Moore and Fabian Vogt discovered that Qt incorrectly handled\ncertain malformed BMP images. If a user or automated system were tricked\ninto opening a specially crafted BMP image, a remote attacker could use\nthis issue to cause Qt to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2015-1858)\n\nRichard Moore and Fabian Vogt discovered that Qt incorrectly handled\ncertain malformed ICO images. If a user or automated system were tricked\ninto opening a specially crafted ICO image, a remote attacker could use\nthis issue to cause Qt to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2015-1859)\n\nRichard Moore and Fabian Vogt discovered that Qt incorrectly handled\ncertain malformed GIF images. If a user or automated system were tricked\ninto opening a specially crafted GIF image, a remote attacker could use\nthis issue to cause Qt to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2015-1860)\n","status":"published","published":"2015-06-03T13:33:12Z","modified":"2026-04-22T09:13:09.076602Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}