RHSA-2021:4172 - Security Advisory

Topic

An update for qt5 is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Qt is a software toolkit for developing applications.

The following packages have been upgraded to a later upstream version: adwaita-qt (1.2.1), python-qt5 (5.15.0), qgnomeplatform (0.7.1), qt5 (5.15.2), qt5-qt3d (5.15.2), qt5-qtbase (5.15.2), qt5-qtconnectivity (5.15.2), qt5-qtdeclarative (5.15.2), qt5-qtdoc (5.15.2), qt5-qtgraphicaleffects (5.15.2), qt5-qtimageformats (5.15.2), qt5-qtlocation (5.15.2), qt5-qtmultimedia (5.15.2), qt5-qtquickcontrols (5.15.2), qt5-qtquickcontrols2 (5.15.2), qt5-qtscript (5.15.2), qt5-qtsensors (5.15.2), qt5-qtserialbus (5.15.2), qt5-qtserialport (5.15.2), qt5-qtsvg (5.15.2), qt5-qttools (5.15.2), qt5-qttranslations (5.15.2), qt5-qtwayland (5.15.2), qt5-qtwebchannel (5.15.2), qt5-qtwebsockets (5.15.2), qt5-qtx11extras (5.15.2), qt5-qtxmlpatterns (5.15.2), sip (4.19.24). (BZ#1928156)

Security Fix(es):

• qt: Out of bounds read in function QRadialFetchSimd from crafted svg file (CVE-2021-3481)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for x86_64 8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x

Fixes

• BZ - 1928156 - [Rebase] Rebase Qt5 to Qt 5.15
• BZ - 1930039 - Rebase qt5-doc to Qt 5.15.2
• BZ - 1930040 - Rebase qt5-qtbase to Qt 5.15.2
• BZ - 1930041 - Rebase qt5-qtcanvas3d to Qt 5.15.2
• BZ - 1930042 - Rebase qt5-qtconnectivity to Qt 5.15.2
• BZ - 1930043 - Rebase qt5-qtdeclarative to Qt 5.15.2
• BZ - 1930044 - Rebase qt5-qtdoc to Qt 5.15.2
• BZ - 1930045 - Rebase qt5-qtgraphicaleffects to Qt 5.15.2
• BZ - 1930046 - Rebase qt5-qtimageformats to Qt 5.15.2
• BZ - 1930047 - Rebase qt5-qtlocation to Qt 5.15.2
• BZ - 1930048 - Rebase qt5-qtmultimedia to Qt 5.15.2
• BZ - 1930049 - Rebase qt5-qtquickcontrols to Qt 5.15.2
• BZ - 1930050 - Rebase qt5-qtquickcontrols2 to Qt 5.15.2
• BZ - 1930051 - Rebase qt5-qtscript to Qt 5.15.2
• BZ - 1930052 - Rebase qt5-qtsensors to Qt 5.15.2
• BZ - 1930053 - Rebase qt5-qtserialbus to Qt 5.15.2
• BZ - 1930054 - Rebase qt5-qtserialport to Qt 5.15.2
• BZ - 1930055 - Rebase qt5-qtsvg to Qt 5.15.2
• BZ - 1930056 - Rebase qt5-qttools to Qt 5.15.2
• BZ - 1930057 - Rebase qt5-qttranslations to Qt 5.15.2
• BZ - 1930058 - Rebase qt5-qtwayland to Qt 5.15.2
• BZ - 1930059 - Rebase qt5-qtwebchannel to Qt 5.15.2
• BZ - 1930060 - Rebase qt5-qtwebsockets to Qt 5.15.2
• BZ - 1930061 - Rebase qt5-qtxmlpatterns to Qt 5.15.2
• BZ - 1930062 - Rebase qt5-qtx11extras to Qt 5.15.2
• BZ - 1930063 - Rebase qt5-qt3d to Qt 5.15.2
• BZ - 1930073 - Rebase QGnomePlatform to 0.7.0
• BZ - 1930074 - Rebase Adwaita-qt to 1.3.0
• BZ - 1931444 - CVE-2021-3481 qt: Out of bounds read in function QRadialFetchSimd from crafted svg file
• BZ - 1949066 - Rebase python-qt5 to support Qt 5.15
• BZ - 1949080 - Rebase sip to 4.19.23

CVEs

• CVE-2021-3481

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/