Mageia alert MGASA-2020-0080 (qtbase5)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
             
 
updates-announce@ml.mageia.org 
Subject:
             
 
[updates-announce] MGASA-2020-0080: Updated qtbase5 packages fix security vulnerabilities 
Date:
             
 
Sun, 9 Feb 2020 20:14:42 +0100
Message-ID:
             
 
<20200209191442.95F129F641@duvel.mageia.org>
MGASA-2020-0080 - Updated qtbase5 packages fix security vulnerabilities

Publication date: 09 Feb 2020
URL: https://advisories.mageia.org/MGASA-2020-0080.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2020-0569,
     CVE-2020-0570

Description:
Updated qtbase5 packages fix security vulnerabilities:

QPluginLoader in Qt versions 5.0.0 through 5.13.2 would search for certain
plugins first on the current working directory of the application, which
allows an attacker that can place files in the file system and influence
the working directory of Qt-based applications to load and execute
malicious code (CVE-2020-0569).

QLibrary in Qt versions 5.12.0 through 5.14.0, on certain x86 machines,
would search for certain libraries and plugins relative to current working
directory of the application, which allows an attacker that can place files
in the file system and influence the working directory of Qt-based
applications to load and execute malicious code (CVE-2020-0570).

Also, a file conflict that caused issues when upgrading from Mageia 6 has
been fixed (mga#25418)

References:
- https://bugs.mageia.org/show_bug.cgi?id=26153
- https://bugs.mageia.org/show_bug.cgi?id=25418
- https://www.openwall.com/lists/oss-security/2020/01/30/1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0569
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0570

SRPMS:
- 7/core/qtbase5-5.12.6-2.mga7