| Package | qt4-x11 |
|---|---|
| Version | 4:4.8.6+git64-g5dc8b2b+dfsg-3+deb8u5 (jessie), 4:4.8.7+dfsg-11+deb9u4 (stretch) |
| Related CVEs | CVE-2023-32573 CVE-2023-32763 CVE-2023-34410 CVE-2023-37369 CVE-2023-38197 |
Several vulnerabilities have been found in qt4-x11, a graphical windowing toolkit.
CVE-2021-3481
While rendering and displaying a crafted Scalable Vector Graphics
(SVG) file this flaw may lead to an unauthorized memory access. The
highest threat from this vulnerability is to data confidentiality
and the application availability.
CVE-2021-45930
An out-of-bounds write in
QtPrivate::QCommonArrayOps<QPainterPath::Element>::growAppend
(called from QPainterPath::addPath and QPathClipper::intersect).
CVE-2023-32573
Uninitialized variable usage in m_unitsPerEm.
CVE-2023-32763
An application crash in QXmlStreamReader via a crafted XML string
that triggers a situation in which a prefix is greater than a
length.
CVE-2023-34410
Certificate validation for TLS does not always consider whether the
root of a chain is a configured CA certificate.
CVE-2023-37369
There can be an application crash in QXmlStreamReader via a crafted
XML string that triggers a situation in which a prefix is greater
than a length.
CVE-2023-38197
There are infinite loops in recursive entity expansion.
For Debian 8 jessie, these problems have been fixed in version 4:4.8.6+git64-g5dc8b2b+dfsg-3+deb8u5.
For Debian 9 stretch, these problems have been fixed in version 4:4.8.7+dfsg-11+deb9u4.
We recommend that you upgrade your qt4-x11 packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.