Synopsis

Moderate: qt4 security update

Type/Severity

Security Advisory: Moderate

Topic

Updated qt4 packages that fix two security issues are now available for Red
Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Description

Qt 4 is a software toolkit that simplifies the task of writing and
maintaining GUI (Graphical User Interface) applications for the X Window
System. HarfBuzz is an OpenType text shaping engine.

A flaw in the way Qt 4 expanded certain UTF-8 characters could be used to
prevent a Qt 4 based application from properly sanitizing user input.
Depending on the application, this could allow an attacker to perform
directory traversal, or for web applications, a cross-site scripting (XSS)
attack. (CVE-2007-0242)

A buffer overflow flaw was found in the harfbuzz module in Qt 4. If a user
loaded a specially-crafted font file with an application linked against Qt
4, it could cause the application to crash or, possibly, execute arbitrary
code with the privileges of the user running the application.
(CVE-2011-3193)

Users of Qt 4 should upgrade to these updated packages, which contain
backported patches to correct these issues. All running applications linked
against Qt 4 libraries must be restarted for this update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 234633 - CVE-2007-0242 QT UTF8 improper character expansion
• BZ - 733118 - CVE-2011-3193 qt/harfbuzz buffer overflow

CVEs

• CVE-2007-0242
• CVE-2011-3193

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 5

SRPM
qt4-4.2.1-1.el5_7.1.src.rpm	SHA-256: a9d1accb772b0d982b12033670e32017007eb2bc0ea34c9332077275aa0bc245
x86_64
qt4-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 9d9f580ff6b5cd9fd2cb1a1a234c6ee67436f93ff89b5ce7f0a32bae441d15e2
qt4-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 032e15409fe9df0da40ba8434fec561063c23e20322bb9211300e0630592db6d
qt4-devel-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 293cec387ccf4e3afe6d655beb8ad3d0cbadeae46a80907ac34f34abbdfb4933
qt4-devel-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 96a1fe77864f4e7b752ca7745669d3bb08f18eee92dcffb57bf65306337d5ada
qt4-doc-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 95c69a4f7e30a12a503da6db40a4df049af0210226c6d8b209088149250a8d88
qt4-mysql-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 7e0509b583ba94e2c8423ae1a163259bfef92f594f447b4c18a49e8bd692dd81
qt4-odbc-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 82200be35fa6046a2ec46076f9fae3548c2cb442165ba563e582648cb2bbcbeb
qt4-postgresql-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 989689963a98802ab856e29018a11e47cf2434220f7a8ed862de89c54b367d93
qt4-sqlite-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: afdef5d8c23bcbb634549cc01eea568811ab6a9104c2e5c67405abe0e501c669
ia64
qt4-4.2.1-1.el5_7.1.ia64.rpm	SHA-256: 787a18cf5db2a8d476130c74c530ca5c28c9ba54b2a360c9badfbd8218f5b38b
qt4-devel-4.2.1-1.el5_7.1.ia64.rpm	SHA-256: e8d9d54999cd851b59aab9f771fbd46363f20a59c28427f00f82ab6ff38ae061
qt4-doc-4.2.1-1.el5_7.1.ia64.rpm	SHA-256: 989be555c04cc97c55628e0750efc944673739f58c132058c97f63a73747af5b
qt4-mysql-4.2.1-1.el5_7.1.ia64.rpm	SHA-256: 4a98b55b21cc80b560bf25bd86afbd55396c533adcef43154e6d0179fa2c783e
qt4-odbc-4.2.1-1.el5_7.1.ia64.rpm	SHA-256: a7c3b4979f9f51a3f0d90179ef49fb25625fb3b8d294c89bc230043b2cbb685a
qt4-postgresql-4.2.1-1.el5_7.1.ia64.rpm	SHA-256: 0de6ca910f63c12b0116821159e5973b78de85f54745a507b3f2926b5b41f0ef
qt4-sqlite-4.2.1-1.el5_7.1.ia64.rpm	SHA-256: f811899174933c0118337f48f7763a0a1660fad741cc1169b0f9f000187e4d1d
i386
qt4-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 9d9f580ff6b5cd9fd2cb1a1a234c6ee67436f93ff89b5ce7f0a32bae441d15e2
qt4-devel-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 293cec387ccf4e3afe6d655beb8ad3d0cbadeae46a80907ac34f34abbdfb4933
qt4-doc-4.2.1-1.el5_7.1.i386.rpm	SHA-256: df26a2bc8dcb3d0bb4a0b165199433a0ba3303232725131b04cfdb8ecdcffdaf
qt4-mysql-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 01c12f0f1fdc36d5887e6096716e06bc6c0e7f173a3e9108815bedad0eaff3c7
qt4-odbc-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 69e18b14344ea640413b6eec766ffa802fe9f055ba62dc03538f13ad7d0e6e63
qt4-postgresql-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 13dd215b84ce35cad6faee9e2af25c52a197b59436742fad2abc4c8a9cabeba6
qt4-sqlite-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 0e8448eef0fa3e93e5ead40a3f40a18070ba62b79908ef253f190438691ae0b7

Red Hat Enterprise Linux Workstation 5

SRPM
qt4-4.2.1-1.el5_7.1.src.rpm	SHA-256: a9d1accb772b0d982b12033670e32017007eb2bc0ea34c9332077275aa0bc245
x86_64
qt4-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 9d9f580ff6b5cd9fd2cb1a1a234c6ee67436f93ff89b5ce7f0a32bae441d15e2
qt4-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 032e15409fe9df0da40ba8434fec561063c23e20322bb9211300e0630592db6d
qt4-devel-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 293cec387ccf4e3afe6d655beb8ad3d0cbadeae46a80907ac34f34abbdfb4933
qt4-devel-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 96a1fe77864f4e7b752ca7745669d3bb08f18eee92dcffb57bf65306337d5ada
qt4-doc-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 95c69a4f7e30a12a503da6db40a4df049af0210226c6d8b209088149250a8d88
qt4-mysql-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 7e0509b583ba94e2c8423ae1a163259bfef92f594f447b4c18a49e8bd692dd81
qt4-odbc-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 82200be35fa6046a2ec46076f9fae3548c2cb442165ba563e582648cb2bbcbeb
qt4-postgresql-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 989689963a98802ab856e29018a11e47cf2434220f7a8ed862de89c54b367d93
qt4-sqlite-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: afdef5d8c23bcbb634549cc01eea568811ab6a9104c2e5c67405abe0e501c669
i386
qt4-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 9d9f580ff6b5cd9fd2cb1a1a234c6ee67436f93ff89b5ce7f0a32bae441d15e2
qt4-devel-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 293cec387ccf4e3afe6d655beb8ad3d0cbadeae46a80907ac34f34abbdfb4933
qt4-doc-4.2.1-1.el5_7.1.i386.rpm	SHA-256: df26a2bc8dcb3d0bb4a0b165199433a0ba3303232725131b04cfdb8ecdcffdaf
qt4-mysql-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 01c12f0f1fdc36d5887e6096716e06bc6c0e7f173a3e9108815bedad0eaff3c7
qt4-odbc-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 69e18b14344ea640413b6eec766ffa802fe9f055ba62dc03538f13ad7d0e6e63
qt4-postgresql-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 13dd215b84ce35cad6faee9e2af25c52a197b59436742fad2abc4c8a9cabeba6
qt4-sqlite-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 0e8448eef0fa3e93e5ead40a3f40a18070ba62b79908ef253f190438691ae0b7

Red Hat Enterprise Linux Desktop 5

SRPM
qt4-4.2.1-1.el5_7.1.src.rpm	SHA-256: a9d1accb772b0d982b12033670e32017007eb2bc0ea34c9332077275aa0bc245
x86_64
qt4-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 9d9f580ff6b5cd9fd2cb1a1a234c6ee67436f93ff89b5ce7f0a32bae441d15e2
qt4-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 032e15409fe9df0da40ba8434fec561063c23e20322bb9211300e0630592db6d
qt4-doc-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 95c69a4f7e30a12a503da6db40a4df049af0210226c6d8b209088149250a8d88
qt4-mysql-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 7e0509b583ba94e2c8423ae1a163259bfef92f594f447b4c18a49e8bd692dd81
qt4-odbc-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 82200be35fa6046a2ec46076f9fae3548c2cb442165ba563e582648cb2bbcbeb
qt4-postgresql-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 989689963a98802ab856e29018a11e47cf2434220f7a8ed862de89c54b367d93
qt4-sqlite-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: afdef5d8c23bcbb634549cc01eea568811ab6a9104c2e5c67405abe0e501c669
i386
qt4-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 9d9f580ff6b5cd9fd2cb1a1a234c6ee67436f93ff89b5ce7f0a32bae441d15e2
qt4-doc-4.2.1-1.el5_7.1.i386.rpm	SHA-256: df26a2bc8dcb3d0bb4a0b165199433a0ba3303232725131b04cfdb8ecdcffdaf
qt4-mysql-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 01c12f0f1fdc36d5887e6096716e06bc6c0e7f173a3e9108815bedad0eaff3c7
qt4-odbc-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 69e18b14344ea640413b6eec766ffa802fe9f055ba62dc03538f13ad7d0e6e63
qt4-postgresql-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 13dd215b84ce35cad6faee9e2af25c52a197b59436742fad2abc4c8a9cabeba6
qt4-sqlite-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 0e8448eef0fa3e93e5ead40a3f40a18070ba62b79908ef253f190438691ae0b7

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
qt4-4.2.1-1.el5_7.1.src.rpm	SHA-256: a9d1accb772b0d982b12033670e32017007eb2bc0ea34c9332077275aa0bc245
s390x
qt4-4.2.1-1.el5_7.1.s390.rpm	SHA-256: fbacdb4f2d174bc8d75b3f331a90db1a4f828e7120cabf2a018bdf7bef6d3242
qt4-4.2.1-1.el5_7.1.s390x.rpm	SHA-256: 4b5f59539923a35f84a2b850e6997b1315061d2d129bdac09e550fa685ce7e38
qt4-devel-4.2.1-1.el5_7.1.s390.rpm	SHA-256: 60f7b86c571544d3f146152ab4142df95837f85eefc0b8e2cd5b9bc8b3d27f0e
qt4-devel-4.2.1-1.el5_7.1.s390x.rpm	SHA-256: bfa36e03c135e6f75ab79fabfba2bd6c3c2eb496b40da5410b275d179b95cd57
qt4-doc-4.2.1-1.el5_7.1.s390x.rpm	SHA-256: 9c10b010f393c094aaf28ed4ce62d1c83a3a685a87e88a45e9cd19ced471f576
qt4-mysql-4.2.1-1.el5_7.1.s390x.rpm	SHA-256: 165b755439e2e7fe55ac0351b3076938db622673cbf7d53696411ea9d5362e4e
qt4-odbc-4.2.1-1.el5_7.1.s390x.rpm	SHA-256: e25975375bb19db6949bab85b94bbd1ddb37e271a84f8509f671f2bef43e4fce
qt4-postgresql-4.2.1-1.el5_7.1.s390x.rpm	SHA-256: 44c4a0dec1a5e897c5357a71a421bb3142f3298ebf868be9fbb7cfda6f3df90a
qt4-sqlite-4.2.1-1.el5_7.1.s390x.rpm	SHA-256: eb45f63122041493df9af5d20e12784deaeb4223b3e8fa1fee9ba242e5605e82

Red Hat Enterprise Linux for Power, big endian 5

SRPM
qt4-4.2.1-1.el5_7.1.src.rpm	SHA-256: a9d1accb772b0d982b12033670e32017007eb2bc0ea34c9332077275aa0bc245
ppc
qt4-4.2.1-1.el5_7.1.ppc.rpm	SHA-256: 46fa8334064ae777bc88cd4ebd5059b1ad17313d5fd07a49c781c198ac96bee2
qt4-4.2.1-1.el5_7.1.ppc64.rpm	SHA-256: 0fb6f1ed2c9fb6af61987cafa196d8d834421a5de3281a5cf0336e9827670414
qt4-devel-4.2.1-1.el5_7.1.ppc.rpm	SHA-256: 81de954dcf6d08d1c353c4f15ea8a6495e48220b84c051c418a399db8ba4297c
qt4-devel-4.2.1-1.el5_7.1.ppc64.rpm	SHA-256: a4be93bc996c08a38d2a45aa03d726c20fd489333cb1a4e0ec18d9612e7d4cd5
qt4-doc-4.2.1-1.el5_7.1.ppc.rpm	SHA-256: 465becfc6609d3caef10edd5a4ee90d5d4c4e8db23ac9ee20d0afd8d3f01ffaa
qt4-mysql-4.2.1-1.el5_7.1.ppc.rpm	SHA-256: e2f75f12a4efd389a94ebd6aeb4eb4237c3713b946d1618383f136a069e5df79
qt4-odbc-4.2.1-1.el5_7.1.ppc.rpm	SHA-256: 4324257fb65f17c380d60c19020c06bd939b7864380eaa64a40e7d9364ef4b3c
qt4-postgresql-4.2.1-1.el5_7.1.ppc.rpm	SHA-256: 9a0632191faf44039189d153f5f8b4726765af356e855fab4060c95c903d0e57
qt4-sqlite-4.2.1-1.el5_7.1.ppc.rpm	SHA-256: 7a205c322e2ab533cca60bc551547a4218bc5a377645e0d8f3780c20899e61a4

Red Hat Enterprise Linux Server from RHUI 5

SRPM
qt4-4.2.1-1.el5_7.1.src.rpm	SHA-256: a9d1accb772b0d982b12033670e32017007eb2bc0ea34c9332077275aa0bc245
x86_64
qt4-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 9d9f580ff6b5cd9fd2cb1a1a234c6ee67436f93ff89b5ce7f0a32bae441d15e2
qt4-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 032e15409fe9df0da40ba8434fec561063c23e20322bb9211300e0630592db6d
qt4-devel-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 293cec387ccf4e3afe6d655beb8ad3d0cbadeae46a80907ac34f34abbdfb4933
qt4-devel-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 96a1fe77864f4e7b752ca7745669d3bb08f18eee92dcffb57bf65306337d5ada
qt4-doc-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 95c69a4f7e30a12a503da6db40a4df049af0210226c6d8b209088149250a8d88
qt4-mysql-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 7e0509b583ba94e2c8423ae1a163259bfef92f594f447b4c18a49e8bd692dd81
qt4-odbc-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 82200be35fa6046a2ec46076f9fae3548c2cb442165ba563e582648cb2bbcbeb
qt4-postgresql-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: 989689963a98802ab856e29018a11e47cf2434220f7a8ed862de89c54b367d93
qt4-sqlite-4.2.1-1.el5_7.1.x86_64.rpm	SHA-256: afdef5d8c23bcbb634549cc01eea568811ab6a9104c2e5c67405abe0e501c669
i386
qt4-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 9d9f580ff6b5cd9fd2cb1a1a234c6ee67436f93ff89b5ce7f0a32bae441d15e2
qt4-devel-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 293cec387ccf4e3afe6d655beb8ad3d0cbadeae46a80907ac34f34abbdfb4933
qt4-doc-4.2.1-1.el5_7.1.i386.rpm	SHA-256: df26a2bc8dcb3d0bb4a0b165199433a0ba3303232725131b04cfdb8ecdcffdaf
qt4-mysql-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 01c12f0f1fdc36d5887e6096716e06bc6c0e7f173a3e9108815bedad0eaff3c7
qt4-odbc-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 69e18b14344ea640413b6eec766ffa802fe9f055ba62dc03538f13ad7d0e6e63
qt4-postgresql-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 13dd215b84ce35cad6faee9e2af25c52a197b59436742fad2abc4c8a9cabeba6
qt4-sqlite-4.2.1-1.el5_7.1.i386.rpm	SHA-256: 0e8448eef0fa3e93e5ead40a3f40a18070ba62b79908ef253f190438691ae0b7