This update for libqt5-qtimageformats fixes the following issues :

Security issues fixed :

CVE-2018-19871: Fixed CPU exhaustion in QTgaFile (bsc#1118598)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has qt5-qtimageformats packages installed that are affected by a vulnerability:

  - An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption.
    (CVE-2018-19871)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The following packages have been upgraded to a later upstream version:
qt5-qt3d (5.9.7), qt5-qtbase (5.9.7), qt5-qtcanvas3d (5.9.7), qt5-qtconnectivity (5.9.7), qt5-qtdeclarative (5.9.7), qt5-qtdoc (5.9.7), qt5-qtgraphicaleffects (5.9.7), qt5-qtimageformats (5.9.7), qt5-qtlocation (5.9.7), qt5-qtmultimedia (5.9.7), qt5-qtquickcontrols (5.9.7), qt5-qtquickcontrols2 (5.9.7), qt5-qtscript (5.9.7), qt5-qtsensors (5.9.7), qt5-qtserialbus (5.9.7), qt5-qtserialport (5.9.7), qt5-qtsvg (5.9.7), qt5-qttools (5.9.7), qt5-qttranslations (5.9.7), qt5-qtwayland (5.9.7), qt5-qtwebchannel (5.9.7), qt5-qtwebsockets (5.9.7), qt5-qtx11extras (5.9.7), qt5-qtxmlpatterns (5.9.7).

Security Fix(es) :

  - qt5-qtbase: Double free in QXmlStreamReader     (CVE-2018-15518)

  - qt5-qtsvg: Invalid parsing of malformed url reference     resulting in a denial of service (CVE-2018-19869)

  - qt5-qtbase: QImage allocation failure in qgifhandler     (CVE-2018-19870)

  - qt5-qtimageformats: QTgaFile CPU exhaustion     (CVE-2018-19871)

  - qt5-qtbase: QBmpHandler segmentation fault on malformed     BMP file (CVE-2018-19873)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1172 advisory.

  - QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted     illegal XML document. (CVE-2018-15518)

  - An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in     qsvghandler.cpp. (CVE-2018-19869)

  - An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in     QGifHandler resulting in a segmentation fault. (CVE-2018-19870)

  - An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption.
    (CVE-2018-19871)

  - An issue was discovered in Qt 5.11. A malformed PPM image causes a division by zero and a crash in     qppmhandler.cpp. (CVE-2018-19872)

  - An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.
    (CVE-2018-19873)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has qt5-qtdoc packages installed that are affected by multiple vulnerabilities:

  - QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted     illegal XML document. (CVE-2018-15518)

  - An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in     qsvghandler.cpp. (CVE-2018-19869)

  - An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in     QGifHandler resulting in a segmentation fault. (CVE-2018-19870)

  - An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption.
    (CVE-2018-19871)

  - An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.
    (CVE-2018-19873)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has qt5-qttranslations packages installed that are affected by multiple vulnerabilities:

  - QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted     illegal XML document. (CVE-2018-15518)

  - An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in     qsvghandler.cpp. (CVE-2018-19869)

  - An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in     QGifHandler resulting in a segmentation fault. (CVE-2018-19870)

  - An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption.
    (CVE-2018-19871)

  - An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.
    (CVE-2018-19873)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has qt5-qtxmlpatterns packages installed that are affected by multiple vulnerabilities:

  - QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted     illegal XML document. (CVE-2018-15518)

  - An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in     qsvghandler.cpp. (CVE-2018-19869)

  - An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in     QGifHandler resulting in a segmentation fault. (CVE-2018-19870)

  - An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption.
    (CVE-2018-19871)

  - An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.
    (CVE-2018-19873)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1665 advisory.

    python-qt5     [5.13.1-1]
    - 5.13.1       Resolves: bz#1775603

    qgnomeplatform     [0.4-3]
    - Rebuild (qt5)       Resolves: bz#1774418

    qt5     [5.12.5-3]
    - Re-add srpm macros, just leave them empty       Resolves: bz#1733133

    [5.12.5-2]
    - Drop srpm macros as we dont ship qtwebengine       Resolves: bz#1733133

    [5.12.5-1]
    - 5.12.5 + sync with Fedora       Resolves: bz#1733133

    qt5-qt3d     [5.12.5-2]
    - Fix multilib issue       Resolves: bz#1765637

    [5.12.5-1]
    - 5.12.5       Resolves: bz#1733159

    qt5-qtbase     [5.12-5-4]
    - Fix build on RHEL 7 kernel       Resolves: bz#1733135

    [5.12-5-2]
    - Remove Android specific test to avoid unnecessary dependencies       Resolves: bz#1733135

    [5.12-5-1]
    - 5.12.5 + sync with Fedora       Resolves: bz#1733135

    qt5-qtcanvas3d     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733136

    qt5-qtconnectivity     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733137

    qt5-qtdeclarative     [5.12-5-1]
    - 5.12.5       Resolves: bz#1733139

    qt5-qtdoc     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733140

    qt5-qtgraphicaleffects     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733141

    qt5-qtimageformats     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733142

    qt5-qtlocation     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733143

    qt5-qtmultimedia     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733144

    qt5-qtquickcontrols2     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733146

    qt5-qtquickcontrols     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733145

    qt5-qtscript     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733147

    qt5-qtsensors     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733148

    qt5-qtserialbus     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733149

    qt5-qtserialport     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733150

    qt5-qtsvg     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733151

    qt5-qttools     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733152

    qt5-qttranslations     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733153

    qt5-qtwayland     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733154

    qt5-qtwebchannel     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733155

    qt5-qtwebsockets     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733156

    qt5-qtx11extras     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733158

    qt5-qtxmlpatterns     [5.12.5-1]
    - 5.12.5       Resolves: bz#1733157

    sip     [4.19.19-1]
    - 4.19.19       Resolves: bz#1775604

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-4200:01 advisory.

    * qt5-qtbase: Double free in QXmlStreamReader (CVE-2018-15518)
      * qt5-qtsvg: Invalid parsing of malformed url reference resulting in a denial     of service (CVE-2018-19869)
      * qt5-qtbase: QImage allocation failure in qgifhandler (CVE-2018-19870)
      * qt5-qtimageformats: QTgaFile CPU exhaustion (CVE-2018-19871)
      * qt5-qtbase: QBmpHandler segmentation fault on malformed BMP file     (CVE-2018-19873)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption.
    (CVE-2018-19871)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
143837	SUSE SLES12 Security Update : libqt5-qtimageformats (SUSE-SU-2020:2923-1)	Nessus	SuSE Local Security Checks	2020/12/9	2024/2/5	medium
143932	NewStart CGSL CORE 5.05 / MAIN 5.05 : qt5-qtimageformats Vulnerability (NS-SA-2020-0099)	Nessus	NewStart CGSL Local Security Checks	2020/12/9	2020/12/10	medium
128258	Scientific Linux Security Update : qt5 on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	2019/8/27	2024/5/1	critical
135349	CentOS 7 : qt (RHSA-2020:1172)	Nessus	CentOS Local Security Checks	2020/4/10	2024/10/9	critical
123063	SUSE SLED15 / SLES15 Security Update : libqt5-qtimageformats (SUSE-SU-2019:0705-1)	Nessus	SuSE Local Security Checks	2019/3/25	2024/6/13	medium
174069	NewStart CGSL CORE 5.05 / MAIN 5.05 : qt5-qtdoc Multiple Vulnerabilities (NS-SA-2023-0018)	Nessus	NewStart CGSL Local Security Checks	2023/4/11	2023/4/11	critical
174088	NewStart CGSL CORE 5.05 / MAIN 5.05 : qt5-qttranslations Multiple Vulnerabilities (NS-SA-2023-0014)	Nessus	NewStart CGSL Local Security Checks	2023/4/11	2023/4/11	critical
174096	NewStart CGSL CORE 5.05 / MAIN 5.05 : qt5-qtxmlpatterns Multiple Vulnerabilities (NS-SA-2023-0020)	Nessus	NewStart CGSL Local Security Checks	2023/4/11	2023/4/11	critical
180963	Oracle Linux 8 : qt5 (ELSA-2020-1665)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	medium
288925	MiracleLinux 7 : [security - medium] qt5 (AXSA:2019-4200:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/20	high
257616	Linux Distros Unpatched Vulnerability : CVE-2018-19871	Nessus	Misc.	2025/8/27	2026/9/2	medium

检测

插件搜索

medium

medium

critical

critical

medium

critical

critical

critical

medium

high

medium