libqt4-xml: vulnerable to billion laughs attack (CVE-2013-4549)

Debian Bug report logs - #750141
libqt4-xml: vulnerable to billion laughs attack (CVE-2013-4549)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Hamish Moffatt <hamish@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libqt4-xml: vulnerable to billion laughs attack

Date: Mon, 02 Jun 2014 11:19:05 +1000

Package: libqt4-xml
Severity: serious
Tags: security
Justification: security

Qt 4.8.6 has a fix for a denial of service attack due to XML entity
expansion ("billion laughs attack"). This fix doesn't seem to be in the
wheezy packages yet.

http://blog.qt.digia.com/blog/2014/04/24/qt-4-8-6-released/

Ubuntu patched their 4.8.4;

https://bugs.launchpad.net/ubuntu/+source/qt4-x11/+bug/1259577



Hamish


-- System Information:
Debian Release: 7.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.13-0.bpo.1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_AU.UTF-8, LC_CTYPE=en_AU.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Message #10 received at 750141@bugs.debian.org (full text, mbox, reply):

From: "Lisandro Damián Nicanor Pérez Meyer" <perezmeyer@gmail.com>

To: 750141@bugs.debian.org, 750141-submitter@bugs.debian.org, Debian Bug Tracking System <control@bugs.debian.org>

Subject: Re: Bug#750141: libqt4-xml: vulnerable to billion laughs attack

Date: Sun, 01 Jun 2014 23:30:15 -0300

[Message part 1 (text/plain, inline)]

tag 750141 moreinfo
thanks

On Monday 02 June 2014 11:19:05 Hamish Moffatt wrote:
> Package: libqt4-xml
> Severity: serious
> Tags: security
> Justification: security
> 
> Qt 4.8.6 has a fix for a denial of service attack due to XML entity
> expansion ("billion laughs attack"). This fix doesn't seem to be in the
> wheezy packages yet.
> 
> http://blog.qt.digia.com/blog/2014/04/24/qt-4-8-6-released/
> 
> Ubuntu patched their 4.8.4;
> 
> https://bugs.launchpad.net/ubuntu/+source/qt4-x11/+bug/1259577

Hi Hamish! I patched Qt4 for jessie at that time but IIRC (I might be mixing 
CVEs here) when I asked someone from the security team over IRC (or maybe by 
mail, I don't remember now) they told me it wasn't too important to get an 
update in stable.

Now if you can give me an example that shows it deserves an RC bug I can 
prepare a fix.

Thanks, Lisandro.

-- 
16: De quien es Internet
    * De DIOS dado que todas las cosas del mundo le pertenecen
    Damian Nadales
    http://mx.grulic.org.ar/lurker/message/20080307.141449.a70fb2fc.es.html

Lisandro Damián Nicanor Pérez Meyer
http://perezmeyer.com.ar/
http://perezmeyer.blogspot.com/

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 750141@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 750141@bugs.debian.org

Cc: 750141-submitter@bugs.debian.org, jmm@debian.org

Subject: Re: Bug#750141: libqt4-xml: vulnerable to billion laughs attack

Date: Mon, 9 Jun 2014 07:17:04 +0200

Hi,

On Sun, Jun 01, 2014 at 11:30:15PM -0300, Lisandro Damián Nicanor Pérez Meyer wrote:
> tag 750141 moreinfo
> thanks
> 
> On Monday 02 June 2014 11:19:05 Hamish Moffatt wrote:
> > Package: libqt4-xml
> > Severity: serious
> > Tags: security
> > Justification: security
> > 
> > Qt 4.8.6 has a fix for a denial of service attack due to XML entity
> > expansion ("billion laughs attack"). This fix doesn't seem to be in the
> > wheezy packages yet.
> > 
> > http://blog.qt.digia.com/blog/2014/04/24/qt-4-8-6-released/
> > 
> > Ubuntu patched their 4.8.4;
> > 
> > https://bugs.launchpad.net/ubuntu/+source/qt4-x11/+bug/1259577
> 
> Hi Hamish! I patched Qt4 for jessie at that time but IIRC (I might be mixing 
> CVEs here) when I asked someone from the security team over IRC (or maybe by 
> mail, I don't remember now) they told me it wasn't too important to get an 
> update in stable.

Yep, perl mail It was on 2013-12-06, where Moritz had written:

Hi Lisandro,
this doesn't warrant a DSA. It can be fixed through a point update, though
or we can line it up for a future QT DSA.

Cheers,
        Moritz

For the BTS, I think this was fixed in 4:4.8.5+git192-g085f851+dfsg-1.

Regards,
Salvatore

Message #34 received at 750141@bugs.debian.org (full text, mbox, reply):

From: Hamish Moffatt <hamish@cloud.net.au>

To: Salvatore Bonaccorso <carnil@debian.org>, 750141-quiet@bugs.debian.org, 750141@bugs.debian.org

Cc: 750141-submitter@bugs.debian.org, jmm@debian.org

Subject: Re: Bug#750141: libqt4-xml: vulnerable to billion laughs attack

Date: Mon, 09 Jun 2014 21:01:46 +1000

On 09/06/14 15:17, Salvatore Bonaccorso wrote:
> Hi,
>
> On Sun, Jun 01, 2014 at 11:30:15PM -0300, Lisandro Damián Nicanor Pérez Meyer wrote:
>> tag 750141 moreinfo
>> thanks
>>
>> On Monday 02 June 2014 11:19:05 Hamish Moffatt wrote:
>>> Package: libqt4-xml
>>> Severity: serious
>>> Tags: security
>>> Justification: security
>>>
>>> Qt 4.8.6 has a fix for a denial of service attack due to XML entity
>>> expansion ("billion laughs attack"). This fix doesn't seem to be in the
>>> wheezy packages yet.
>>>
>>> http://blog.qt.digia.com/blog/2014/04/24/qt-4-8-6-released/
>>>
>>> Ubuntu patched their 4.8.4;
>>>
>>> https://bugs.launchpad.net/ubuntu/+source/qt4-x11/+bug/1259577
>> Hi Hamish! I patched Qt4 for jessie at that time but IIRC (I might be mixing
>> CVEs here) when I asked someone from the security team over IRC (or maybe by
>> mail, I don't remember now) they told me it wasn't too important to get an
>> update in stable.
> Yep, perl mail It was on 2013-12-06, where Moritz had written:
>
> Hi Lisandro,
> this doesn't warrant a DSA. It can be fixed through a point update, though
> or we can line it up for a future QT DSA.
>
> Cheers,
>          Moritz
>
> For the BTS, I think this was fixed in 4:4.8.5+git192-g085f851+dfsg-1.
>

Hi. OK I guess I can understand it not being too important to update 
stable; while there are quite a lot of rdepends for libqt4-xml I don't 
see many daemons among them. Depends on whether libqt4-xml is just being 
used for config or whether to decode wire protocols, ie those apps could 
be vulnerable to remote denial of service. mumble-server is one daemon I 
notice..


Thanks
Hamish

Message #47 received at 750141@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Hamish Moffatt <hamish@cloud.net.au>

Cc: Salvatore Bonaccorso <carnil@debian.org>, 750141-quiet@bugs.debian.org, 750141@bugs.debian.org, 750141-submitter@bugs.debian.org, jmm@debian.org

Subject: Re: Bug#750141: libqt4-xml: vulnerable to billion laughs attack

Date: Tue, 10 Jun 2014 17:57:14 +0200

On Mon, Jun 09, 2014 at 09:01:46PM +1000, Hamish Moffatt wrote:
> On 09/06/14 15:17, Salvatore Bonaccorso wrote:
>> Hi,
>>
>> On Sun, Jun 01, 2014 at 11:30:15PM -0300, Lisandro Damián Nicanor Pérez Meyer wrote:
>>> tag 750141 moreinfo
>>> thanks
>>>
>>> On Monday 02 June 2014 11:19:05 Hamish Moffatt wrote:
>>>> Package: libqt4-xml
>>>> Severity: serious
>>>> Tags: security
>>>> Justification: security
>>>>
>>>> Qt 4.8.6 has a fix for a denial of service attack due to XML entity
>>>> expansion ("billion laughs attack"). This fix doesn't seem to be in the
>>>> wheezy packages yet.
>>>>
>>>> http://blog.qt.digia.com/blog/2014/04/24/qt-4-8-6-released/
>>>>
>>>> Ubuntu patched their 4.8.4;
>>>>
>>>> https://bugs.launchpad.net/ubuntu/+source/qt4-x11/+bug/1259577
>>> Hi Hamish! I patched Qt4 for jessie at that time but IIRC (I might be mixing
>>> CVEs here) when I asked someone from the security team over IRC (or maybe by
>>> mail, I don't remember now) they told me it wasn't too important to get an
>>> update in stable.
>> Yep, perl mail It was on 2013-12-06, where Moritz had written:
>>
>> Hi Lisandro,
>> this doesn't warrant a DSA. It can be fixed through a point update, though
>> or we can line it up for a future QT DSA.
>>
>> Cheers,
>>          Moritz
>>
>> For the BTS, I think this was fixed in 4:4.8.5+git192-g085f851+dfsg-1.
>>
>
> Hi. OK I guess I can understand it not being too important to update  
> stable; while there are quite a lot of rdepends for libqt4-xml I don't  
> see many daemons among them. Depends on whether libqt4-xml is just being  
> used for config or whether to decode wire protocols, ie those apps could  
> be vulnerable to remote denial of service. mumble-server is one daemon I  
> notice..

If someone wants to see this fixed, please handle this through a Wheezy point 
update:
https://www.debian.org/doc/manuals/developers-reference/pkgs.html#upload-stable

Cheers,
        Moritz

Message #60 received at 750141-done@bugs.debian.org (full text, mbox, reply):

From: Emilio Pozuelo Monfort <pochu@debian.org>

To: 750141-done@bugs.debian.org

Subject: Re: Bug#750141: libqt4-xml: vulnerable to billion laughs attack

Date: Tue, 29 Jan 2019 14:45:19 +0100

Version: 4:4.8.5+git192-g085f851+dfsg-1

On Mon, 9 Jun 2014 07:17:04 +0200 Salvatore Bonaccorso <carnil@debian.org> wrote:
> Hi,
> 
> On Sun, Jun 01, 2014 at 11:30:15PM -0300, Lisandro Damián Nicanor Pérez Meyer wrote:
> > tag 750141 moreinfo
> > thanks
> > 
> > On Monday 02 June 2014 11:19:05 Hamish Moffatt wrote:
> > > Package: libqt4-xml
> > > Severity: serious
> > > Tags: security
> > > Justification: security
> > > 
> > > Qt 4.8.6 has a fix for a denial of service attack due to XML entity
> > > expansion ("billion laughs attack"). This fix doesn't seem to be in the
> > > wheezy packages yet.
> > > 
> > > http://blog.qt.digia.com/blog/2014/04/24/qt-4-8-6-released/
> > > 
> > > Ubuntu patched their 4.8.4;
> > > 
> > > https://bugs.launchpad.net/ubuntu/+source/qt4-x11/+bug/1259577
> > 
> > Hi Hamish! I patched Qt4 for jessie at that time but IIRC (I might be mixing 
> > CVEs here) when I asked someone from the security team over IRC (or maybe by 
> > mail, I don't remember now) they told me it wasn't too important to get an 
> > update in stable.
> 
> Yep, perl mail It was on 2013-12-06, where Moritz had written:
> 
> Hi Lisandro,
> this doesn't warrant a DSA. It can be fixed through a point update, though
> or we can line it up for a future QT DSA.
> 
> Cheers,
>         Moritz
> 
> For the BTS, I think this was fixed in 4:4.8.5+git192-g085f851+dfsg-1.

Closing as this is fixed in unstable. Also wheezy is EOL so there's no point in
keeping this bug open anymore.

Emilio

Send a report that this bug log contains spam.