[SECURITY] [DSA 1292-1] New qt4-x11 packages fix cross-site scripting vulnerability

2007-05-1522:22:07

lists.debian.org

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

JSON

Debian Security Advisory DSA-1292-1 [email protected]
http://www.debian.org/security/ Noah Meyerhans
May 15, 2007

Package : qt4-x11
Vulnerability : missing input validation
Problem type : local (remote)
Debian-specific: no
CVE Id(s) : CVE-2007-0242
BugTraq ID : 23269
Debian Bug : 417391

Andreas Nolden discovered a bug in the UTF8 decoding routines in
qt4-x11, a C++ GUI library framework, that could allow remote
attackers to conduct cross-site scripting (XSS) and directory
traversal attacks via long sequences that decode to dangerous
metacharacters.

For the stable distribution (etch), this problem has been fixed in version
4.2.1-2etch1

For the testing and unstable distribution (lenny and sid, respectively),
this problem has been fixed in version 4.2.2-2

We recommend that you upgrade your qt4-x11 package.

Upgrade instructions

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian (stable)

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/q/qt4-x11/qt4-x11_4.2.1-2etch1.dsc
Size/MD5 checksum: 1390 4c2ac9fc65dc3d31b90473d7ec038f1f
http://security.debian.org/pool/updates/main/q/qt4-x11/qt4-x11_4.2.1.orig.tar.gz
Size/MD5 checksum: 37069122 2ab1c88084f55b94809f025a8503bf18
http://security.debian.org/pool/updates/main/q/qt4-x11/qt4-x11_4.2.1-2etch1.diff.gz
Size/MD5 checksum: 22806 26c69455f8d09fffdfb9413a18f69174

Architecture independent packages:

http://security.debian.org/pool/updates/main/q/qt4-x11/qt4-doc_4.2.1-2etch1_all.deb
Size/MD5 checksum: 21219244 450031c80fd48650103cb7dfb72ea4d3

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

These files will probably be moved into the stable distribution on
its next update.

For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: [email protected]
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

OSVersionArchitecturePackageVersionFilename
Debian4alphalibqt4-debug< 4.2.1-2etch1libqt4-debug_4.2.1-2etch1_alpha.deb
Debian4alphaqt4-qtconfig< 4.2.1-2etch1qt4-qtconfig_4.2.1-2etch1_alpha.deb
Debian4mipslibqt4-core< 4.2.1-2etch1libqt4-core_4.2.1-2etch1_mips.deb
Debian4ia64libqt4-core< 4.2.1-2etch1libqt4-core_4.2.1-2etch1_ia64.deb
Debian4s390qt4-designer< 4.2.1-2etch1qt4-designer_4.2.1-2etch1_s390.deb
Debian4mipsellibqt4-debug< 4.2.1-2etch1libqt4-debug_4.2.1-2etch1_mipsel.deb
Debian4amd64libqt4-sql< 4.2.1-2etch1libqt4-sql_4.2.1-2etch1_amd64.deb
Debian4s390qt4-qtconfig< 4.2.1-2etch1qt4-qtconfig_4.2.1-2etch1_s390.deb
Debian4ia64libqt4-debug< 4.2.1-2etch1libqt4-debug_4.2.1-2etch1_ia64.deb
Debian4mipsqt4-designer< 4.2.1-2etch1qt4-designer_4.2.1-2etch1_mips.deb

OS	Version	Architecture	Package	Version	Filename
Debian	4	alpha	libqt4-debug	< 4.2.1-2etch1	libqt4-debug_4.2.1-2etch1_alpha.deb
Debian	4	alpha	qt4-qtconfig	< 4.2.1-2etch1	qt4-qtconfig_4.2.1-2etch1_alpha.deb
Debian	4	mips	libqt4-core	< 4.2.1-2etch1	libqt4-core_4.2.1-2etch1_mips.deb
Debian	4	ia64	libqt4-core	< 4.2.1-2etch1	libqt4-core_4.2.1-2etch1_ia64.deb
Debian	4	s390	qt4-designer	< 4.2.1-2etch1	qt4-designer_4.2.1-2etch1_s390.deb
Debian	4	mipsel	libqt4-debug	< 4.2.1-2etch1	libqt4-debug_4.2.1-2etch1_mipsel.deb
Debian	4	amd64	libqt4-sql	< 4.2.1-2etch1	libqt4-sql_4.2.1-2etch1_amd64.deb
Debian	4	s390	qt4-qtconfig	< 4.2.1-2etch1	qt4-qtconfig_4.2.1-2etch1_s390.deb
Debian	4	ia64	libqt4-debug	< 4.2.1-2etch1	libqt4-debug_4.2.1-2etch1_ia64.deb
Debian	4	mips	qt4-designer	< 4.2.1-2etch1	qt4-designer_4.2.1-2etch1_mips.deb