Sicherheit: Zwei Probleme in qt3
Aktuelle Meldungen Distributionen
Name: Zwei Probleme in qt3
ID: FEDORA-2018-0a0da2f3b7
Distribution: Fedora
Plattformen: Fedora 27
Datum: So, 10. Juni 2018, 16:16
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10040
Applikationen: Qt


Fedora Update Notification
2018-06-09 19:45:50.208325

Name : qt3
Product : Fedora 27
Version : 3.3.8b
Release : 74.fc27
URL : http://www.troll.no
Summary : The shared library for the Qt 3 GUI toolkit
Description :
Qt is a GUI software toolkit which simplifies the task of writing and
maintaining GUI (Graphical User Interface) applications
for the X Window System.

Qt is written in C++ and is fully object-oriented.

This package contains the shared library needed to run Qt 3
applications, as well as the README files for Qt 3.

Update Information:

This update fixes CVE-2016-10040, a stack overflow in QXmlSimpleReader due to a
too lenient entityCharacterLimit in our version of the patch for CVE-2013-4549.
(The limit was increased from the upstream 1024 to 65536 to address
an issue where the security fix was breaking existing real-world XML files.
Unfortunately, that is too much to actually fit on the CPU stack. This fix
decreases the limit to 4096.) It also fixes the QMySql driver to work with the
version of MariaDB in Fedora 27.

* Thu May 31 2018 Kevin Kofler <Kevin@tigcc.ticalc.org> - 3.3.8b-74
- Fix CVE-2016-10040 (stack overflow in QXmlSimpleReader due to a too high
entityCharacterLimit in the CVE-2013-4549 patch) (#1409603)
* Fri Feb 9 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> -
- Escape macros in %changelog
* Mon Nov 13 2017 Than Ngo <than@redhat.com> - 3.3.8b-72
- backport mysql driver mariadb fix
- BR: mariadb-connector-c-devel (f28+, #1494085)

[ 1 ] Bug #1409597 - CVE-2016-10040 qt: stack overflow in QXmlSimpleReader

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-0a0da2f3b7' at the command
line. For more information, refer to the dnf documentation available at

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O2W3BNHY5P3AWOYWZNGJYDLLXOO52T3C/
Pro-Linux @Twitter
Neue Nachrichten