Richard J. Moore and Peter Hartmann discovered that Qt allowed redirecting requests from http to file schemes. If an attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information. This issue only affected Ubuntu 11.10, Ubuntu 12.04 LTS, and Ubuntu 12.10. (CVE-2012-5624)

Stephen Cheng discovered that Qt may report incorrect errors when ssl certificate verification fails. (CVE-2012-6093)

Tim Brown and Mark Lowe discovered that Qt incorrectly used weak permissions on shared memory segments. A local attacker could use this issue to view sensitive information, or modify program data belonging to other users. (CVE-2013-0254).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Add cert-blacklist-more.diff,     cert-blacklist-tuerktrust.diff :

  - blacklist more evil certificates

  - Add weak-ssl-certificates.diff :

  - blacklist weak certificates

  - enable linked support for OpenSSL

  - openssl-incompatibility-fix.diff: Fix wrong error     reporting when using a binary incompatible version of     openSSL (bnc#797006, CVE-2012-6093)

This build fixes a security issues :

  - QSslSocket may report incorrect errors when certificate     verification fails. For more information:
    http://lists.qt-project.org/pipermail/announce/2013-Janu     ary/000020.html

  - blacklists unauthorized SSL certificates by Turktrust.
    For more information:
    http://lists.qt-project.org/pipermail/announce/2013-Janu     ary/000021.html

This build also produces a new qt-designer-plugin-webkit subpackage containing QtWebKit designer plugin.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libqt4 has been updated to fix several security issues.

  - An information disclosure via QSharedMemory was fixed     which allowed local attackers to read information (e.g.
    bitmap content) from the attacked user. (CVE-2013-0254)

  - openssl-incompatibility-fix.diff: Fix wrong error     reporting when using a binary incompatible version of     openSSL. (bnc#797006, CVE-2012-6093)

  - Various compromised SSL root certificates were     blacklisted. Also a non-security bugfix has been applied :

  - Add fix for qdbusviewer not matching args (bnc#784197)

libqt4 was updated to fix various issues regarding to SSL and certificates.

  - various more compromised SSL root and intermediate     certificates were blacklisted

  - Fix wrong error reporting when using a binary     incompatible version of openSSL (bnc#797006,     CVE-2012-6093)

Bugfixes done :

  - enable linked support for OpenSSL

  - Add fix for qdbusviewer not matching args (bnc#784197)

ID	Name	Product	Family	Published	Updated	Severity
64638	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : qt4-x11 vulnerabilities (USN-1723-1)	Nessus	Ubuntu Local Security Checks	2/15/2013	9/19/2019	medium
75062	openSUSE Security Update : libqt4 (openSUSE-SU-2013:0204-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	medium
63649	Fedora 18 : qt-4.8.4-6.fc18 (2013-0199)	Nessus	Fedora Local Security Checks	1/23/2013	1/11/2021	medium
65567	SuSE 11.2 Security Update : libqt4 (SAT Patch Number 7441)	Nessus	SuSE Local Security Checks	3/15/2013	1/19/2021	medium
65568	SuSE 11.2 Security Update : libqt4 (SAT Patch Number 7441)	Nessus	SuSE Local Security Checks	3/15/2013	1/19/2021	medium
63509	Fedora 17 : qt-4.8.4-6.fc17 (2013-0277)	Nessus	Fedora Local Security Checks	1/14/2013	1/11/2021	medium
64084	Fedora 16 : qt-4.8.4-6.fc16 (2013-0270)	Nessus	Fedora Local Security Checks	1/25/2013	1/11/2021	medium
75211	openSUSE Security Update : libqt4 (openSUSE-SU-2013:0256-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium