ELA-929-1 qt4-x11 security update
Package : qt4-x11
Version : 4:4.8.6+git64-g5dc8b2b+dfsg-3+deb8u5 (jessie), 4:4.8.7+dfsg-11+deb9u4 (stretch)
Related CVEs :
CVE-2023-32573
CVE-2023-32763
CVE-2023-34410
CVE-2023-37369
CVE-2023-38197
Several vulnerabilities have been found in qt4-x11, a graphical
windowing toolkit.
CVE-2021-3481
While rendering and displaying a crafted Scalable Vector Graphics
(SVG) file this flaw may lead to an unauthorized memory access. The
highest threat from this vulnerability is to data confidentiality
and the application availability.
CVE-2021-45930
An out-of-bounds write in
QtPrivate::QCommonArrayOps::growAppend
(called from QPainterPath::addPath and QPathClipper::intersect).
CVE-2023-32573
Uninitialized variable usage in m_unitsPerEm.
CVE-2023-32763
An application crash in QXmlStreamReader via a crafted XML string
that triggers a situation in which a prefix is greater than a
length.
CVE-2023-34410
Certificate validation for TLS does not always consider whether the
root of a chain is a configured CA certificate.
CVE-2023-37369
There can be an application crash in QXmlStreamReader via a crafted
XML string that triggers a situation in which a prefix is greater
than a length.
CVE-2023-38197
There are infinite loops in recursive entity expansion.
A qt4-x11 security update has been released for Debian GNU/Linux 8 and 9 Extended LTS to address several vulnerabilities.
