Oracle Linux 7:qt5 (ELSA-2019-2135)

critical Nessus 插件 ID 180876

简介

远程 Oracle Linux 主机缺少一个或多个安全更新。

描述

远程 Oracle Linux 7 主机上安装的多个程序包受到 ELSA-2019-2135 公告中提及的多个漏洞影响。

5.11.3 版本之前的 Qt 5.x 中的 QXmlStream 在解析特制的非法 XML 文档时存在双重释放或损坏。(CVE-2018-15518)

- 在 5.11.3 之前的 Qt 中发现一个问题。格式错误的 SVG 图像会导致 qsvghandler.cpp 中产生段错误。(CVE-2018-19869)

- 在 5.11.3 之前的 Qt 中发现一个问题。QBmpHandler 中存在通过 BMP 数据触发的缓冲区溢出。
(CVE-2018-19873)

- 在 5.11.3 之前的 Qt 中发现一个问题。格式错误的 GIF 图像会导致 QGifHandler 中出现空指针取消引用,从而产生段错误。(CVE-2018-19870)

- 在 5.11.3 之前的 Qt 中发现一个问题。QTgaFile 存在不受控制的资源消耗。
(CVE-2018-19871)

请注意,Nessus 尚未测试这些问题,而是只依据应用程序自我报告的版本号进行判断。

解决方案

更新受影响的程序包。

另见

https://linux.oracle.com/errata/ELSA-2019-2135.html

插件详情

严重性: Critical

ID: 180876

文件名: oraclelinux_ELSA-2019-2135.nasl

版本: 1.0

类型: local

代理: unix

发布时间: 2023/9/7

最近更新时间: 2023/9/7

支持的传感器: Frictionless Assessment Agent, Nessus Agent, Nessus

风险信息

VPR

风险因素: Medium

分数: 5.9

CVSS v2

风险因素: High

基本分数: 7.5

时间分数: 5.5

矢量: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS 分数来源: CVE-2018-19873

CVSS v3

风险因素: Critical

基本分数: 9.8

时间分数: 8.5

矢量: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

时间矢量: CVSS:3.0/E:U/RL:O/RC:C

漏洞信息

CPE: p-cpe:/a:oracle:linux:qt5-qttools-examples, p-cpe:/a:oracle:linux:qt5-qttools-libs-designer, p-cpe:/a:oracle:linux:qt5-qttools-libs-designercomponents, p-cpe:/a:oracle:linux:qt5-qttools-libs-help, p-cpe:/a:oracle:linux:qt5-qttools-static, p-cpe:/a:oracle:linux:qt5-qttranslations, p-cpe:/a:oracle:linux:qt5-qtwayland, p-cpe:/a:oracle:linux:qt5-qtwayland-devel, p-cpe:/a:oracle:linux:qt5-qtwayland-doc, p-cpe:/a:oracle:linux:qt5-qtwayland-examples, p-cpe:/a:oracle:linux:qt5-qtwebchannel, p-cpe:/a:oracle:linux:qt5-qtwebchannel-devel, p-cpe:/a:oracle:linux:qt5-qtwebchannel-doc, p-cpe:/a:oracle:linux:qt5-qtwebchannel-examples, p-cpe:/a:oracle:linux:qt5-qtwebsockets, p-cpe:/a:oracle:linux:qt5-qtwebsockets-devel, p-cpe:/a:oracle:linux:qt5-qtwebsockets-doc, p-cpe:/a:oracle:linux:qt5-qtwebsockets-examples, p-cpe:/a:oracle:linux:qt5-qtx11extras, p-cpe:/a:oracle:linux:qt5-qtx11extras-devel, p-cpe:/a:oracle:linux:qt5-qtx11extras-doc, p-cpe:/a:oracle:linux:qt5-qtxmlpatterns, p-cpe:/a:oracle:linux:qt5-qtxmlpatterns-devel, p-cpe:/a:oracle:linux:qt5-qtxmlpatterns-doc, p-cpe:/a:oracle:linux:qt5-qtxmlpatterns-examples, p-cpe:/a:oracle:linux:qt5-rpm-macros, cpe:/o:oracle:linux:7, p-cpe:/a:oracle:linux:qt5-assistant, p-cpe:/a:oracle:linux:qt5-designer, p-cpe:/a:oracle:linux:qt5-doctools, p-cpe:/a:oracle:linux:qt5-linguist, p-cpe:/a:oracle:linux:qt5-qdbusviewer, p-cpe:/a:oracle:linux:qt5-qt3d, p-cpe:/a:oracle:linux:qt5-qt3d-devel, p-cpe:/a:oracle:linux:qt5-qt3d-doc, p-cpe:/a:oracle:linux:qt5-qt3d-examples, p-cpe:/a:oracle:linux:qt5-qtbase, p-cpe:/a:oracle:linux:qt5-qtbase-common, p-cpe:/a:oracle:linux:qt5-qtbase-devel, p-cpe:/a:oracle:linux:qt5-qtbase-doc, p-cpe:/a:oracle:linux:qt5-qtbase-examples, p-cpe:/a:oracle:linux:qt5-qtbase-gui, p-cpe:/a:oracle:linux:qt5-qtbase-mysql, p-cpe:/a:oracle:linux:qt5-qtbase-odbc, p-cpe:/a:oracle:linux:qt5-qtbase-postgresql, p-cpe:/a:oracle:linux:qt5-qtbase-static, p-cpe:/a:oracle:linux:qt5-qtcanvas3d, p-cpe:/a:oracle:linux:qt5-qtcanvas3d-doc, p-cpe:/a:oracle:linux:qt5-qtcanvas3d-examples, p-cpe:/a:oracle:linux:qt5-qtconnectivity, p-cpe:/a:oracle:linux:qt5-qtconnectivity-devel, p-cpe:/a:oracle:linux:qt5-qtconnectivity-doc, p-cpe:/a:oracle:linux:qt5-qtconnectivity-examples, p-cpe:/a:oracle:linux:qt5-qtdeclarative, p-cpe:/a:oracle:linux:qt5-qtdeclarative-devel, p-cpe:/a:oracle:linux:qt5-qtdeclarative-doc, p-cpe:/a:oracle:linux:qt5-qtdeclarative-examples, p-cpe:/a:oracle:linux:qt5-qtdeclarative-static, p-cpe:/a:oracle:linux:qt5-qtdoc, p-cpe:/a:oracle:linux:qt5-qtgraphicaleffects, p-cpe:/a:oracle:linux:qt5-qtgraphicaleffects-doc, p-cpe:/a:oracle:linux:qt5-qtimageformats, p-cpe:/a:oracle:linux:qt5-qtimageformats-doc, p-cpe:/a:oracle:linux:qt5-qtlocation, p-cpe:/a:oracle:linux:qt5-qtlocation-devel, p-cpe:/a:oracle:linux:qt5-qtlocation-doc, p-cpe:/a:oracle:linux:qt5-qtlocation-examples, p-cpe:/a:oracle:linux:qt5-qtmultimedia, p-cpe:/a:oracle:linux:qt5-qtmultimedia-devel, p-cpe:/a:oracle:linux:qt5-qtmultimedia-doc, p-cpe:/a:oracle:linux:qt5-qtmultimedia-examples, p-cpe:/a:oracle:linux:qt5-qtquickcontrols, p-cpe:/a:oracle:linux:qt5-qtquickcontrols-doc, p-cpe:/a:oracle:linux:qt5-qtquickcontrols-examples, p-cpe:/a:oracle:linux:qt5-qtquickcontrols2, p-cpe:/a:oracle:linux:qt5-qtquickcontrols2-devel, p-cpe:/a:oracle:linux:qt5-qtquickcontrols2-doc, p-cpe:/a:oracle:linux:qt5-qtquickcontrols2-examples, p-cpe:/a:oracle:linux:qt5-qtscript, p-cpe:/a:oracle:linux:qt5-qtscript-devel, p-cpe:/a:oracle:linux:qt5-qtscript-doc, p-cpe:/a:oracle:linux:qt5-qtscript-examples, p-cpe:/a:oracle:linux:qt5-qtsensors, p-cpe:/a:oracle:linux:qt5-qtsensors-devel, p-cpe:/a:oracle:linux:qt5-qtsensors-doc, p-cpe:/a:oracle:linux:qt5-qtsensors-examples, p-cpe:/a:oracle:linux:qt5-qtserialbus, p-cpe:/a:oracle:linux:qt5-qtserialbus-devel, p-cpe:/a:oracle:linux:qt5-qtserialbus-doc, p-cpe:/a:oracle:linux:qt5-qtserialbus-examples, p-cpe:/a:oracle:linux:qt5-qtserialport, p-cpe:/a:oracle:linux:qt5-qtserialport-devel, p-cpe:/a:oracle:linux:qt5-qtserialport-doc, p-cpe:/a:oracle:linux:qt5-qtserialport-examples, p-cpe:/a:oracle:linux:qt5-qtsvg, p-cpe:/a:oracle:linux:qt5-qtsvg-devel, p-cpe:/a:oracle:linux:qt5-qtsvg-doc, p-cpe:/a:oracle:linux:qt5-qtsvg-examples, p-cpe:/a:oracle:linux:qt5-qttools, p-cpe:/a:oracle:linux:qt5-qttools-common, p-cpe:/a:oracle:linux:qt5-qttools-devel, p-cpe:/a:oracle:linux:qt5-qttools-doc

必需的 KB 项: Host/OracleLinux, Host/RedHat/release, Host/RedHat/rpm-list, Host/local_checks_enabled

易利用性: No known exploits are available

补丁发布日期: 2019/8/13

漏洞发布日期: 2018/12/4

参考资料信息

CVE: CVE-2018-15518, CVE-2018-19869, CVE-2018-19870, CVE-2018-19871, CVE-2018-19873