9.3 - USN-1504-1

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 11.04 - Ubuntu 10.04 LTS

Summary:

Qt Applications could be made to crash or run programs as your login if they opened specially crafted files.

Software Description: - qt4-x11: transitional package for Qt 4 assistant module

Details:

It was discovered that Qt did not properly handle wildcard domain names or IP addresses in the Common Name field of X.509 certificates. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. This issue only affected Ubuntu 10.04 LTS. (CVE-2010-5076)

A heap-based buffer overflow was discovered in the HarfBuzz module. If a user were tricked into opening a crafted font file in a Qt application, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-3193)

It was discovered that Qt did not properly handle greyscale TIFF images. If a Qt application could be made to process a crafted TIFF file, an attacker could cause a denial of service. (CVE-2011-3194)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 11.04:
libqt4-network 4:4.7.2-0ubuntu6.4
libqtgui4 4:4.7.2-0ubuntu6.4

Ubuntu 10.04 LTS:
libqt4-network 4:4.6.2-0ubuntu5.4
libqtgui4 4:4.6.2-0ubuntu5.4

After a standard system update you need to restart your session to make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1504-1
CVE-2010-5076, CVE-2011-3193, CVE-2011-3194

Package Information:
https://launchpad.net/ubuntu/+source/qt4-x11/4:4.7.2-0ubuntu6.4
https://launchpad.net/ubuntu/+source/qt4-x11/4:4.6.2-0ubuntu5.4