qt4-x11: CVE-2015-0295

Debian Bug report logs - #779550
qt4-x11: CVE-2015-0295

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: qt4-x11: CVE-2015-0295

Date: Mon, 02 Mar 2015 07:58:09 +0100

Package: qt4-x11
Severity: important
Tags: security
Justification: user security hole

Hi,
please see http://lists.qt-project.org/pipermail/announce/2015-February/000059.html
for details and a patch.

Cheers,
        Moritz

Message #10 received at 779550@bugs.debian.org (full text, mbox, reply):

From: "Lisandro Damián Nicanor Pérez Meyer" <perezmeyer@gmail.com>

To: Moritz Muehlenhoff <jmm@inutil.org>, 779550@bugs.debian.org

Subject: Re: Bug#779550: qt4-x11: CVE-2015-0295

Date: Mon, 02 Mar 2015 10:18:40 -0300

[Message part 1 (text/plain, inline)]

On Monday 02 March 2015 07:58:09 Moritz Muehlenhoff wrote:
> Package: qt4-x11
> Severity: important
> Tags: security
> Justification: user security hole
> 
> Hi,
> please see
> http://lists.qt-project.org/pipermail/announce/2015-February/000059.html
> for details and a patch.
> 
> Cheers,
>         Moritz

And we have the same bug for Qt5 too.

Moritz, do you thing it's grave enough to update jessie via standard methods?

mm, now that I remember we need a tpu for qt5 /o\

-- 
"Any sufficiently advanced technology is indistinguishable from magic"
 Arthur C. Clarke

Lisandro Damián Nicanor Pérez Meyer
http://perezmeyer.com.ar/
http://perezmeyer.blogspot.com/

[signature.asc (application/pgp-signature, inline)]

Message #15 received at 779550@bugs.debian.org (full text, mbox, reply):

From: Dmitry Shachnev <mitya57@debian.org>

To: 779550@bugs.debian.org

Cc: control@bugs.debian.org, Moritz Muehlenhoff <jmm@inutil.org>

Subject: Re: Bug#779550: qt4-x11: CVE-2015-0295

Date: Mon, 02 Mar 2015 19:32:11 +0300

[Message part 1 (text/plain, inline)]

clone -1 -2
reassign -2 libqt5gui5 5.3.2+dfsg-4
thanks

On Mon, 02 Mar 2015 10:18:40 -0300, Lisandro Damián Nicanor Pérez Meyer wrote:
> And we have the same bug for Qt5 too.
>
> Moritz, do you thing it's grave enough to update jessie via standard methods?
>
> mm, now that I remember we need a tpu for qt5 /o\

I think it should not be RC for Qt 5, as we have no DEs in archive
using Qt 5.

Re Qt 4, this can be fixed via unstable so I don't see why not to do it.
But I want to hear Moritz' opinion first.

--
Dmitry Shachnev

[signature.asc (application/pgp-signature, inline)]

Message #22 received at 779550@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Dmitry Shachnev <mitya57@debian.org>

Cc: 779550@bugs.debian.org, control@bugs.debian.org

Subject: Re: Bug#779550: qt4-x11: CVE-2015-0295

Date: Mon, 2 Mar 2015 18:20:22 +0100

On Mon, Mar 02, 2015 at 07:32:11PM +0300, Dmitry Shachnev wrote:
> clone -1 -2
> reassign -2 libqt5gui5 5.3.2+dfsg-4
> thanks
> 
> On Mon, 02 Mar 2015 10:18:40 -0300, Lisandro Damián Nicanor Pérez Meyer wrote:
> > And we have the same bug for Qt5 too.
> >
> > Moritz, do you thing it's grave enough to update jessie via standard methods?
> >
> > mm, now that I remember we need a tpu for qt5 /o\
> 
> I think it should not be RC for Qt 5, as we have no DEs in archive
> using Qt 5.
> 
> Re Qt 4, this can be fixed via unstable so I don't see why not to do it.
> But I want to hear Moritz' opinion first.

Agreed, I didn't file both as RC since it doesn't allow code conjection. 
For Wheezy we can either fix it along with a potential future DSA or
address it via a stable point update.

Both can be fixed for jessie via unstable upload+unblock. They're
security bugs within the limits of what the releases managers unblock
at this point of the freeze.

Cheers,
        Moritz

Message #27 received at 779550@bugs.debian.org (full text, mbox, reply):

From: Lisandro Damián Nicanor Pérez Meyer <perezmeyer@gmail.com>

To: Moritz Muehlenhoff <jmm@inutil.org>, 779550@bugs.debian.org

Subject: Re: Bug#779550: qt4-x11: CVE-2015-0295

Date: Mon, 02 Mar 2015 15:37:03 -0300

[Message part 1 (text/plain, inline)]

On Monday 02 March 2015 18:20:22 Moritz Muehlenhoff wrote:
> On Mon, Mar 02, 2015 at 07:32:11PM +0300, Dmitry Shachnev wrote:
> > clone -1 -2
> > reassign -2 libqt5gui5 5.3.2+dfsg-4
> > thanks
> > 
> > On Mon, 02 Mar 2015 10:18:40 -0300, Lisandro Damián Nicanor Pérez Meyer 
wrote:
> > > And we have the same bug for Qt5 too.
> > > 
> > > Moritz, do you thing it's grave enough to update jessie via standard
> > > methods?
> > > 
> > > mm, now that I remember we need a tpu for qt5 /o\
> > 
> > I think it should not be RC for Qt 5, as we have no DEs in archive
> > using Qt 5.
> > 
> > Re Qt 4, this can be fixed via unstable so I don't see why not to do it.
> > But I want to hear Moritz' opinion first.
> 
> Agreed, I didn't file both as RC since it doesn't allow code conjection.
> For Wheezy we can either fix it along with a potential future DSA or
> address it via a stable point update.
> 
> Both can be fixed for jessie via unstable upload+unblock. They're
> security bugs within the limits of what the releases managers unblock
> at this point of the freeze.

Not Qt5 due to an unvoluntary upload of some X thing that changed build 
dependencies. Qtbase should go trough TPU :-/

-- 
Tiempo para el tiempo y un rato mas.
  Profecías, Vox Dei, basado en Eclesiastes 3:1-9

Lisandro Damián Nicanor Pérez Meyer
http://perezmeyer.com.ar/
http://perezmeyer.blogspot.com/

[signature.asc (application/pgp-signature, inline)]

Message #34 received at 779550-close@bugs.debian.org (full text, mbox, reply):

From: Dmitry Shachnev <mitya57@debian.org>

To: 779550-close@bugs.debian.org

Subject: Bug#779550: fixed in qt4-x11 4:4.8.6+git64-g5dc8b2b+dfsg-3

Date: Tue, 03 Mar 2015 09:25:07 +0000

Source: qt4-x11
Source-Version: 4:4.8.6+git64-g5dc8b2b+dfsg-3

We believe that the bug you reported is fixed in the latest version of
qt4-x11, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 779550@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Dmitry Shachnev <mitya57@debian.org> (supplier of updated qt4-x11 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Mon, 02 Mar 2015 17:12:28 +0300
Source: qt4-x11
Binary: libqtcore4 qtcore4-l10n libqt4-core libqtgui4 libqt4-gui libqt4-network libqt4-opengl libqt4-script libqt4-scripttools libqt4-sql libqt4-sql-ibase libqt4-sql-mysql libqt4-sql-odbc libqt4-sql-psql libqt4-sql-sqlite libqt4-sql-sqlite2 libqt4-sql-tds libqt4-svg libqt4-webkit libqt4-xml libqt4-xmlpatterns libqt4-dbus libqtdbus4 libqt4-qt3support libqt4-designer libqt4-help libqt4-assistant libqt4-test libqt4-phonon libqt4-declarative libqt4-declarative-folderlistmodel libqt4-declarative-gestures libqt4-declarative-particles libqt4-declarative-shaders libqt4-dev libqt4-dev-bin libqt4-private-dev libqt4-opengl-dev libqt4-dbg libqt4-designer-dbg libqt4-qt3support-dbg libqt4-script-dbg libqt4-webkit-dbg libqt4-xmlpatterns-dbg qt4-bin-dbg qt4-demos-dbg qt4-designer qt4-dev-tools qt4-qmake qt4-qtconfig qt4-demos qt4-qmlviewer qt4-linguist-tools qdbus qt4-doc qt4-doc-html qt4-default
Architecture: source all
Version: 4:4.8.6+git64-g5dc8b2b+dfsg-3
Distribution: unstable
Urgency: medium
Maintainer: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Changed-By: Dmitry Shachnev <mitya57@debian.org>
Description:
 libqt4-assistant - transitional package for Qt 4 assistant module
 libqt4-core - transitional package for Qt 4 core non-GUI runtime libraries
 libqt4-dbg - Qt 4 library debugging symbols
 libqt4-dbus - Qt 4 D-Bus module
 libqt4-declarative - Qt 4 Declarative module
 libqt4-declarative-folderlistmodel - Qt 4 folderlistmodel QML plugin
 libqt4-declarative-gestures - Qt 4 gestures QML plugin
 libqt4-declarative-particles - Qt 4 particles QML plugin
 libqt4-declarative-shaders - Qt 4 shaders QML plugin
 libqt4-designer - Qt 4 designer module
 libqt4-designer-dbg - Qt 4 designer library debugging symbols
 libqt4-dev - Qt 4 development files
 libqt4-dev-bin - Qt 4 development programs
 libqt4-gui - transitional package for Qt 4 GUI runtime libraries
 libqt4-help - Qt 4 help module
 libqt4-network - Qt 4 network module
 libqt4-opengl - Qt 4 OpenGL module
 libqt4-opengl-dev - Qt 4 OpenGL library development files
 libqt4-phonon - Qt 4 Phonon module
 libqt4-private-dev - Qt 4 private development files
 libqt4-qt3support - Qt 3 compatibility library for Qt 4
 libqt4-qt3support-dbg - Qt 3 compatibility library for Qt 4 debugging symbols
 libqt4-script - Qt 4 script module
 libqt4-script-dbg - Qt 4 script library debugging symbols
 libqt4-scripttools - Qt 4 script tools module
 libqt4-sql - Qt 4 SQL module
 libqt4-sql-ibase - Qt 4 InterBase/FireBird database driver
 libqt4-sql-mysql - Qt 4 MySQL database driver
 libqt4-sql-odbc - Qt 4 ODBC database driver
 libqt4-sql-psql - Qt 4 PostgreSQL database driver
 libqt4-sql-sqlite - Qt 4 SQLite 3 database driver
 libqt4-sql-sqlite2 - Qt 4 SQLite 2 database driver
 libqt4-sql-tds - Qt 4 FreeTDS database driver
 libqt4-svg - Qt 4 SVG module
 libqt4-test - Qt 4 test module
 libqt4-webkit - transitional package for Qt 4 WebKit module
 libqt4-webkit-dbg - transitional package for Qt 4 WebKit debugging symbols
 libqt4-xml - Qt 4 XML module
 libqt4-xmlpatterns - Qt 4 XML patterns module
 libqt4-xmlpatterns-dbg - Qt 4 XML patterns library debugging symbols
 libqtcore4 - Qt 4 core module
 libqtdbus4 - Qt 4 D-Bus module library
 libqtgui4  - Qt 4 GUI module
 qdbus      - Qt 4 D-Bus tool
 qt4-bin-dbg - Qt 4 binaries debugging symbols
 qt4-default - Qt 4 development defaults package
 qt4-demos  - Qt 4 examples and demos
 qt4-demos-dbg - Qt 4 examples and demos debugging symbols
 qt4-designer - graphical designer for Qt 4 applications
 qt4-dev-tools - Qt 4 development tools
 qt4-doc    - Qt 4 API documentation
 qt4-doc-html - Qt 4 API documentation (HTML format)
 qt4-linguist-tools - Qt 4 Linguist tools
 qt4-qmake  - Qt 4 qmake Makefile generator tool
 qt4-qmlviewer - Qt 4 QML viewer
 qt4-qtconfig - Qt 4 configuration tool
 qtcore4-l10n - Qt 4 core module translations
Closes: 779550
Changes:
 qt4-x11 (4:4.8.6+git64-g5dc8b2b+dfsg-3) unstable; urgency=medium
 .
   * Team upload.
   * Fix CVE-2015-0295 (DoS vulnerability in BMP images handler).
     Closes: #779550.
Checksums-Sha1:
 5f55f1e483563bbddbc9afb2e1ca46a0562b274b 6504 qt4-x11_4.8.6+git64-g5dc8b2b+dfsg-3.dsc
 3c116d2ad3620ecefed3c4c66dce816ab1bbcd5c 313692 qt4-x11_4.8.6+git64-g5dc8b2b+dfsg-3.debian.tar.xz
 cf5b452b546d2d87352414c494cd7a75c889b4dc 652174 qtcore4-l10n_4.8.6+git64-g5dc8b2b+dfsg-3_all.deb
 658e21b6ec9797843210f0076b87f00a856c8691 95886138 qt4-doc_4.8.6+git64-g5dc8b2b+dfsg-3_all.deb
 6e8522ba1248a000efa9350404e36b2c92f6925d 45252538 qt4-doc-html_4.8.6+git64-g5dc8b2b+dfsg-3_all.deb
Checksums-Sha256:
 b707993c7a917b9eb490bc28b8d580a084a2c872a08e4244bd2e9d794d0c211c 6504 qt4-x11_4.8.6+git64-g5dc8b2b+dfsg-3.dsc
 4d19f0699e723e635fadd774557564c7d392c812b49f688684781a461c6c29ab 313692 qt4-x11_4.8.6+git64-g5dc8b2b+dfsg-3.debian.tar.xz
 b0c4cb85a95184c1b703c73aa586c7ad5fd2c3c5b1e13b171ee773cdc5f48d7c 652174 qtcore4-l10n_4.8.6+git64-g5dc8b2b+dfsg-3_all.deb
 b81d7dd93dc1e2285c556e5d86f63cc1234133c376705237e477e938cb254239 95886138 qt4-doc_4.8.6+git64-g5dc8b2b+dfsg-3_all.deb
 39cb7ff595e93957cf4026cf9a6fb349a894f6dbba267cb99056b3d295bd7376 45252538 qt4-doc-html_4.8.6+git64-g5dc8b2b+dfsg-3_all.deb
Files:
 39c119b401e1c08f77c912fe3e31a6b9 6504 libs optional qt4-x11_4.8.6+git64-g5dc8b2b+dfsg-3.dsc
 c28fc1c45c4fd36f192d52cfd9dc56a5 313692 libs optional qt4-x11_4.8.6+git64-g5dc8b2b+dfsg-3.debian.tar.xz
 d78240d3c7e18912c547389279e7c455 652174 libs optional qtcore4-l10n_4.8.6+git64-g5dc8b2b+dfsg-3_all.deb
 b192c9d7a1f1b187571cd0cb5226791a 95886138 doc optional qt4-doc_4.8.6+git64-g5dc8b2b+dfsg-3_all.deb
 85ea826cba2632a632733e5e9f09e071 45252538 doc optional qt4-doc-html_4.8.6+git64-g5dc8b2b+dfsg-3_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJU9VzcAAoJENb+cQNj+F3Tf8UQAJRAEA3xZNCi7Zk2N2ogxcUc
yOy5l80Fj9afzLFKqlXZ+djOsBuE6FmrniU85+uOLL1yqi+0OrjoyOWbR8SUcoyO
DkpZxINlKzcIXXJBhqOF/RN/E1eo/3oicSdgzBv4u8LBk4TrtL7l6SxuUH5lhEJs
xoFUfogutFATJtAtM/xWF+3Eqwqi+VxaomTCIUIS2oAZIgJPztjhCghvgWRg8oH7
IyZPgPowqEaEMTH305IFg0sDdrOD64p4A/FmhmvORBzoovphJ6BsmY/doKKCKbSX
No2pDmW+hfHypGM4fH4xKu8zb7yJfZF5XMObfYq9gzmvfIBqybsRgsNrxPYkwSzj
8X6P/kE505dgVah59haV0KuYvM5uRsdKAjGwfhWYb3C8uQXfKkv+HzPBGp460mXm
Mv2j1hrY2nXyGYKQhKdsXz6fWGmQ/rWHDi7nvG7Ut5TpXHez0sligAgfZAqmfn/y
ioVdJQVUcypxQyl02kBIXzIaWhm+8nzEUbC7aeQIrqJN8GSvGg+dUwVynzIqjQUy
qV5Tc8+By1N/SwLfZXlt2EMm3bDBvm6s039LVMbZNgFxM6fLEWb/Cdaj0PrFu3NG
yl42uCuObPyAc3m+r4JXMWz/tm5o/duM//RndLBaVOKWlp/Qtl94VY9/euxyKr4l
ZkRxEBgMzRpwEe8z12NP
=FEb6
-----END PGP SIGNATURE-----

Message #39 received at 779550@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Lisandro Damián Nicanor Pérez Meyer <perezmeyer@gmail.com>

Cc: Moritz Muehlenhoff <jmm@inutil.org>, 779550@bugs.debian.org

Subject: Re: Bug#779550: qt4-x11: CVE-2015-0295

Date: Sun, 15 Mar 2015 21:05:32 +0100

On Mon, Mar 02, 2015 at 03:37:03PM -0300, Lisandro Damián Nicanor Pérez Meyer wrote:
> On Monday 02 March 2015 18:20:22 Moritz Muehlenhoff wrote:
> > On Mon, Mar 02, 2015 at 07:32:11PM +0300, Dmitry Shachnev wrote:
> > > clone -1 -2
> > > reassign -2 libqt5gui5 5.3.2+dfsg-4
> > > thanks
> > > 
> > > On Mon, 02 Mar 2015 10:18:40 -0300, Lisandro Damián Nicanor Pérez Meyer 
> wrote:
> > > > And we have the same bug for Qt5 too.
> > > > 
> > > > Moritz, do you thing it's grave enough to update jessie via standard
> > > > methods?
> > > > 
> > > > mm, now that I remember we need a tpu for qt5 /o\
> > > 
> > > I think it should not be RC for Qt 5, as we have no DEs in archive
> > > using Qt 5.
> > > 
> > > Re Qt 4, this can be fixed via unstable so I don't see why not to do it.
> > > But I want to hear Moritz' opinion first.
> > 
> > Agreed, I didn't file both as RC since it doesn't allow code conjection.
> > For Wheezy we can either fix it along with a potential future DSA or
> > address it via a stable point update.
> > 
> > Both can be fixed for jessie via unstable upload+unblock. They're
> > security bugs within the limits of what the releases managers unblock
> > at this point of the freeze.
> 
> Not Qt5 due to an unvoluntary upload of some X thing that changed build 
> dependencies. Qtbase should go trough TPU :-/

Is this planned during the freeze? Otherwise can fix it alongin a later point
update or security update for jessie.

Cheers,
        Moritz

Message #44 received at 779550-close@bugs.debian.org (full text, mbox, reply):

From: Raphaël Hertzog <hertzog@debian.org>

To: 779550-close@bugs.debian.org

Subject: Bug#779550: fixed in qt4-x11 4:4.6.3-4+squeeze3

Date: Thu, 30 Apr 2015 10:27:27 +0000

Source: qt4-x11
Source-Version: 4:4.6.3-4+squeeze3

We believe that the bug you reported is fixed in the latest version of
qt4-x11, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 779550@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Raphaël Hertzog <hertzog@debian.org> (supplier of updated qt4-x11 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Wed, 29 Apr 2015 15:43:32 +0200
Source: qt4-x11
Binary: libqtcore4 libqt4-core libqtgui4 libqt4-gui libqt4-network libqt4-opengl libqt4-script libqt4-scripttools libqt4-sql libqt4-sql-ibase libqt4-sql-mysql libqt4-sql-odbc libqt4-sql-psql libqt4-sql-sqlite libqt4-sql-sqlite2 libqt4-sql-tds libqt4-svg libqt4-webkit libqt4-xml libqt4-xmlpatterns libqt4-dbus libqt4-qt3support libqt4-designer libqt4-help libqt4-assistant libqt4-test libqt4-multimedia libqt4-phonon libqt4-dev libqt4-opengl-dev libqt4-dbg libqt4-webkit-dbg libqt4-xmlpatterns-dbg qt4-demos-dbg qt4-designer qt4-dev-tools qt4-qmake qt4-qtconfig qt4-demos qt4-doc qt4-doc-html
Architecture: source amd64 all
Version: 4:4.6.3-4+squeeze3
Distribution: squeeze-lts
Urgency: high
Maintainer: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Changed-By: Raphaël Hertzog <hertzog@debian.org>
Description: 
 libqt4-assistant - Qt 4 assistant module
 libqt4-core - transitional package for Qt 4 core non-GUI runtime libraries
 libqt4-dbg - Qt 4 library debugging symbols
 libqt4-dbus - Qt 4 D-Bus module
 libqt4-designer - Qt 4 designer module
 libqt4-dev - Qt 4 development files
 libqt4-gui - transitional package for Qt 4 GUI runtime libraries
 libqt4-help - Qt 4 help module
 libqt4-multimedia - Qt 4 Multimedia module
 libqt4-network - Qt 4 network module
 libqt4-opengl - Qt 4 OpenGL module
 libqt4-opengl-dev - Qt 4 OpenGL library development files
 libqt4-phonon - Qt 4 Phonon module
 libqt4-qt3support - Qt 3 compatibility library for Qt 4
 libqt4-script - Qt 4 script module
 libqt4-scripttools - Qt 4 script tools module
 libqt4-sql - Qt 4 SQL module
 libqt4-sql-ibase - Qt 4 InterBase/FireBird database driver
 libqt4-sql-mysql - Qt 4 MySQL database driver
 libqt4-sql-odbc - Qt 4 ODBC database driver
 libqt4-sql-psql - Qt 4 PostgreSQL database driver
 libqt4-sql-sqlite - Qt 4 SQLite 3 database driver
 libqt4-sql-sqlite2 - Qt 4 SQLite 2 database driver
 libqt4-sql-tds - Qt 4 FreeTDS database driver
 libqt4-svg - Qt 4 SVG module
 libqt4-test - Qt 4 test module
 libqt4-webkit - Qt 4 WebKit module
 libqt4-webkit-dbg - Qt 4 WebKit library debugging symbols
 libqt4-xml - Qt 4 XML module
 libqt4-xmlpatterns - Qt 4 XML patterns module
 libqt4-xmlpatterns-dbg - Qt 4 XML patterns library debugging symbols
 libqtcore4 - Qt 4 core module
 libqtgui4  - Qt 4 GUI module
 qt4-demos  - Qt 4 examples and demos
 qt4-demos-dbg - Qt 4 examples and demos debugging symbols
 qt4-designer - graphical designer for Qt 4 applications
 qt4-dev-tools - Qt 4 development tools
 qt4-doc    - Qt 4 API documentation
 qt4-doc-html - Qt 4 API documentation (HTML format)
 qt4-qmake  - Qt 4 qmake Makefile generator tool
 qt4-qtconfig - Qt 4 configuration tool
Closes: 779550 783133
Changes: 
 qt4-x11 (4:4.6.3-4+squeeze3) squeeze-lts; urgency=high
 .
   * Non-maintainer upload by the Debian LTS team.
   * Add CVE-2014-0254.patch prepared by Salvatore Bonaccorso. Squeeze LTS
     does not support kfreebsd so the side effect on those architectures
     can be safely ignored.
   * This update includes fixes for multiple security issues:
     - CVE-2014-0254: information leak through world-readable shared memory
       segments
     - CVE-2015-0295 and CVE-2015-1858: denial of service through crafted BMP file
     - CVE-2015-1859: denial of service through crafted ICO file
     - CVE-2015-1860: denial of service through crafted GIF file
     Closes: #779550, #783133
Checksums-Sha1: 
 9ebf4bf547d95c6131785e445a5fe2c8a5687a7b 3034 qt4-x11_4.6.3-4+squeeze3.dsc
 98ee3eb29921b43b3cfff14f7d2285179f994e73 390808 qt4-x11_4.6.3-4+squeeze3.debian.tar.gz
 98750a06c922e9dd6e34c3d736cff32061f8e65c 2506888 libqtcore4_4.6.3-4+squeeze3_amd64.deb
 adb119426a62257c60039aa06ac3f636de497266 34770 libqt4-core_4.6.3-4+squeeze3_amd64.deb
 a0e80ba791e2a406e21c6c7d4e0f33ce6530a471 5117588 libqtgui4_4.6.3-4+squeeze3_amd64.deb
 912fcf2dcc622d15ff47b518dd6badf7a7a2137b 34764 libqt4-gui_4.6.3-4+squeeze3_amd64.deb
 0cd36b5e234524ad91b350e2c775340a77856f68 542920 libqt4-network_4.6.3-4+squeeze3_amd64.deb
 4a452f663dbdc534244a0f1222ac8139df8acbb9 330092 libqt4-opengl_4.6.3-4+squeeze3_amd64.deb
 5f20b03a41abc5ce4e6bac74d222711c8493e7a2 873070 libqt4-script_4.6.3-4+squeeze3_amd64.deb
 dbf9546864750edeb7de8eea48196fcaa082caad 316652 libqt4-scripttools_4.6.3-4+squeeze3_amd64.deb
 ce1ba52997bc3cfba5f19cc05447bebab2478942 146436 libqt4-sql_4.6.3-4+squeeze3_amd64.deb
 a131f4a486186878fbc2fe71561c1c4490d85764 80206 libqt4-sql-ibase_4.6.3-4+squeeze3_amd64.deb
 3b84466e8d1f7bc4622e18842df2b14fed11ddf7 63598 libqt4-sql-mysql_4.6.3-4+squeeze3_amd64.deb
 cf80d475066ef7f77291a6b9de98947ca1007e3c 84476 libqt4-sql-odbc_4.6.3-4+squeeze3_amd64.deb
 bdcd2f7fba6604c91130623b896b561ccd4645c8 66528 libqt4-sql-psql_4.6.3-4+squeeze3_amd64.deb
 656519565bb164c280cace6f40fa8eac73d5d8ca 54786 libqt4-sql-sqlite_4.6.3-4+squeeze3_amd64.deb
 b576bd6a211d2dad6c7aa15c5f1c662207d8caed 50646 libqt4-sql-sqlite2_4.6.3-4+squeeze3_amd64.deb
 0880d196a2325af191b052c0e9bfeebf3b63d7c2 57826 libqt4-sql-tds_4.6.3-4+squeeze3_amd64.deb
 33957f85fb11fcd3f26a9d28a88b5f85e8ae0901 205726 libqt4-svg_4.6.3-4+squeeze3_amd64.deb
 8596d7ba9dad23856bf5c457bcab3bbc64bbbb99 6397284 libqt4-webkit_4.6.3-4+squeeze3_amd64.deb
 1f49e8ba156639e5945b873bb3020bd531288d00 145424 libqt4-xml_4.6.3-4+squeeze3_amd64.deb
 3692c3d447a0125dfd3918f92180ce629eecc0c7 1560108 libqt4-xmlpatterns_4.6.3-4+squeeze3_amd64.deb
 21b7d7d4dfed160dcf6560a7d93f44c0c5df115c 267460 libqt4-dbus_4.6.3-4+squeeze3_amd64.deb
 7652631b3b9744924ba62ecf1b5aa40efebdeda5 1403868 libqt4-qt3support_4.6.3-4+squeeze3_amd64.deb
 71fce0130c3c347e7f425f2d06acc9ae8aa2dc27 5623008 libqt4-designer_4.6.3-4+squeeze3_amd64.deb
 f8d9cc5d48bbe87b134dd6bea724ad3675cf9622 263786 libqt4-help_4.6.3-4+squeeze3_amd64.deb
 2c67100ea99d41f16b3c834a38492c0db9ff3817 46446 libqt4-assistant_4.6.3-4+squeeze3_amd64.deb
 289cf84dc57e8e8553bf1095a617bdd567eb82a0 95772 libqt4-test_4.6.3-4+squeeze3_amd64.deb
 87215b0d99ea8b074b9fd302e8adcdb55de79605 95832 libqt4-multimedia_4.6.3-4+squeeze3_amd64.deb
 7118503e04e1637fac09bd86383424f9ba24b02e 175786 libqt4-phonon_4.6.3-4+squeeze3_amd64.deb
 5360a83e8fbb0469c997037534ba2e120c54a9df 5400934 libqt4-dev_4.6.3-4+squeeze3_amd64.deb
 1d72ffc3dcbd9d5d166cb7b2b34b89d6a2ab214f 50226 libqt4-opengl-dev_4.6.3-4+squeeze3_amd64.deb
 073633aae6e114659cd57cafdeeded62b9a709ee 160067198 libqt4-dbg_4.6.3-4+squeeze3_amd64.deb
 d8d0e7b11df423ebd5289d4a32588a2305f6dc81 163050224 libqt4-webkit-dbg_4.6.3-4+squeeze3_amd64.deb
 0c3c95cb012899583309d1e08621f5ff936c68f3 22086840 libqt4-xmlpatterns-dbg_4.6.3-4+squeeze3_amd64.deb
 ee10bbcd696de6932a25df79b791825a409c88fa 75979032 qt4-demos-dbg_4.6.3-4+squeeze3_amd64.deb
 3f348717dc3f1b05114f39f66ec8694ea04f7fb5 546032 qt4-designer_4.6.3-4+squeeze3_amd64.deb
 06144092d6c1c016d6187d31d6085f7371c40294 5634178 qt4-dev-tools_4.6.3-4+squeeze3_amd64.deb
 67a254f962764922a4122fe2fd8fea4db4498d1b 1629454 qt4-qmake_4.6.3-4+squeeze3_amd64.deb
 ebd350fd9dac3c43a00f852cd0d1d584b959686f 144368 qt4-qtconfig_4.6.3-4+squeeze3_amd64.deb
 cf188a7305ac262ba15156770ffeadef05d344c3 13558466 qt4-demos_4.6.3-4+squeeze3_amd64.deb
 e28c40cc60066ed045cd393e7366a76dbbe31dee 67493618 qt4-doc_4.6.3-4+squeeze3_all.deb
 9976eb13d914f5c5f066d36ed82884de4eda37fd 36065476 qt4-doc-html_4.6.3-4+squeeze3_all.deb
Checksums-Sha256: 
 f0941a9a2fdebfb3dda6fb660fe509942abca6576a1330e64f11982a9b5ce9dc 3034 qt4-x11_4.6.3-4+squeeze3.dsc
 7be293ea689d03866cf72b3c49750b9cee8ed40731edc73ca7a971a42a9063ad 390808 qt4-x11_4.6.3-4+squeeze3.debian.tar.gz
 de16afbc9a56e25da896aab6b84d67049e7f9a66dcc942f7e3b6086bddd27e58 2506888 libqtcore4_4.6.3-4+squeeze3_amd64.deb
 8d277d0c92e4be7d35e97b512a4f077fcbc88c66236a92ac736a2b3ac8dcea55 34770 libqt4-core_4.6.3-4+squeeze3_amd64.deb
 f6cacb53c2344a82ed4271e44380ba2a542ff6c216774a4c4c52b42a82dd01bb 5117588 libqtgui4_4.6.3-4+squeeze3_amd64.deb
 64b87277cc9c7087246478be7ab64f4e9fbe8c40ddd395940cd6d278ae968a82 34764 libqt4-gui_4.6.3-4+squeeze3_amd64.deb
 0f8b151e8b9468ace8b4f8ff3d8f12e65856377284c0b6db113111a501306ee0 542920 libqt4-network_4.6.3-4+squeeze3_amd64.deb
 c5d3c2c588f3e2838de5ec13886716043fa90f4f795aba9efafb95416f874588 330092 libqt4-opengl_4.6.3-4+squeeze3_amd64.deb
 cef871f25bf861a7c760addd0df99c69b112efd1d06fb2c74111f8300e909a89 873070 libqt4-script_4.6.3-4+squeeze3_amd64.deb
 b25bac25539525002581900324619a9beccc4be20d18d521dd704ad85090aaf1 316652 libqt4-scripttools_4.6.3-4+squeeze3_amd64.deb
 6441918b7a7b55fcb4c9415c92ba17cad856fd168b43abe4fd498633e2332dbe 146436 libqt4-sql_4.6.3-4+squeeze3_amd64.deb
 abed6c7604e40ff9feff7e6546faa0258145f5aed44e182c40c5475ae8bf711f 80206 libqt4-sql-ibase_4.6.3-4+squeeze3_amd64.deb
 3c40426ea804eb5868824346fee670ef6dee598e7a36aaa156e2854bac71cce9 63598 libqt4-sql-mysql_4.6.3-4+squeeze3_amd64.deb
 9137fdfd73c1df176c3c063f00605487056537ef5f91eefd6f989af6b564a166 84476 libqt4-sql-odbc_4.6.3-4+squeeze3_amd64.deb
 6c9d52e62486e2cd0761b393e9749fcde4aee9934f4a2f5907399a4a84758f7c 66528 libqt4-sql-psql_4.6.3-4+squeeze3_amd64.deb
 255ca1eaa088256965554ad3a89ba95097f7c3a941ebbe6653b6d5d31ce63ef3 54786 libqt4-sql-sqlite_4.6.3-4+squeeze3_amd64.deb
 5b03916ad2a585834a3409e278dfd94fcb343b1246f158b466676ee594dbd858 50646 libqt4-sql-sqlite2_4.6.3-4+squeeze3_amd64.deb
 a15fd4b67bffce3d59d72ffcfa9c1c1d809b0b37c3fba55f52a6ac60a31db7a8 57826 libqt4-sql-tds_4.6.3-4+squeeze3_amd64.deb
 b77a2bb4bcd9084431f7b30549d250ca915ab604b7238f79f426f28665761eb6 205726 libqt4-svg_4.6.3-4+squeeze3_amd64.deb
 6c447a2bd3636ffa19cb6db6d1a04fe6d28bb5c1ddf2f0d9fa59802f22a06671 6397284 libqt4-webkit_4.6.3-4+squeeze3_amd64.deb
 5e6d98823163538d90cca0c56cde6099f09c048d7733a2801776c7dd1eee2278 145424 libqt4-xml_4.6.3-4+squeeze3_amd64.deb
 4da3d881ac84e80184c0074104d2140a7bfb88656c6690fc7f457ae009414430 1560108 libqt4-xmlpatterns_4.6.3-4+squeeze3_amd64.deb
 1d59bebe6f3f7b960a067e1fd53c485b217e6a1cc5eb0314e737adcb5d53359f 267460 libqt4-dbus_4.6.3-4+squeeze3_amd64.deb
 2781e8d545af82f109c6bcb4e050442f112f9f0bf34173ca22b5a725730c8127 1403868 libqt4-qt3support_4.6.3-4+squeeze3_amd64.deb
 09e748fe3c49ead6d6d9dd916de6940e86168996f395ad7d1c2dad9d6e00c3b6 5623008 libqt4-designer_4.6.3-4+squeeze3_amd64.deb
 3447b08bfdb50e0570f495d24856b847ac9e7a1520c23d611a7969c68ea55548 263786 libqt4-help_4.6.3-4+squeeze3_amd64.deb
 5067be0cddefb01bcf477d8a2625f76b3d042b15a553e40875f42cf67821ffcf 46446 libqt4-assistant_4.6.3-4+squeeze3_amd64.deb
 1ebd2ca0ff94ae8bb392dce701c1559ae43b5649dc7c3314ea4f4a6b12c483eb 95772 libqt4-test_4.6.3-4+squeeze3_amd64.deb
 e0b7635296ff92e93e78de4e40292a5b49caff14ca4cf0e1893986889ddcf498 95832 libqt4-multimedia_4.6.3-4+squeeze3_amd64.deb
 f27dc9080b7838d8c58682435e64b251f1c8c0d4df191bca834cc1ce09e8d5de 175786 libqt4-phonon_4.6.3-4+squeeze3_amd64.deb
 cf8123f38b3f2d02e2513054df9374e7e04495ae2d5c5a20b5d2013f74272368 5400934 libqt4-dev_4.6.3-4+squeeze3_amd64.deb
 e97e6644a2fcb3ced6a79ed5265d3ab95ebebe054d0f524435371036042a07eb 50226 libqt4-opengl-dev_4.6.3-4+squeeze3_amd64.deb
 e374204ef5e4ae55f7160891adc67fa49827a37189391b36165f005746179ae9 160067198 libqt4-dbg_4.6.3-4+squeeze3_amd64.deb
 1977aeca08d34cdab7412f2e14586a96c3aa6641e1421d6c2d34562938161788 163050224 libqt4-webkit-dbg_4.6.3-4+squeeze3_amd64.deb
 c041d56d0f43304fe765428d3fc91441f36d015ceb79ed3c67397e880f90307e 22086840 libqt4-xmlpatterns-dbg_4.6.3-4+squeeze3_amd64.deb
 2db97982129f0a8fc75cc91409eb3f7eba96d6619e2ce7542a48df154a375cad 75979032 qt4-demos-dbg_4.6.3-4+squeeze3_amd64.deb
 379f72e7e1c30aa455c061e6a2cacbe5d0291f93b8513c77af5b71c4eeafd441 546032 qt4-designer_4.6.3-4+squeeze3_amd64.deb
 d25bc4bd6d805a123e26afdee09873d124d070147c44000bde2ec3ca058cf3ed 5634178 qt4-dev-tools_4.6.3-4+squeeze3_amd64.deb
 13a723f52a3acbb2e845ef8be714a770696a3a153a70fccca5f80df702a71990 1629454 qt4-qmake_4.6.3-4+squeeze3_amd64.deb
 b1c484afa4fbc6263adb360006a5140fe9e64a8a36c552dcb22b642e62a67758 144368 qt4-qtconfig_4.6.3-4+squeeze3_amd64.deb
 668e665c93c82c76b5302332f9c753e12454068808f86a0b7064c9f6bb2bbe2a 13558466 qt4-demos_4.6.3-4+squeeze3_amd64.deb
 8006cf9239028826b5339ffe6bf962b3eca4a174e59ca6f18469d439d217db9c 67493618 qt4-doc_4.6.3-4+squeeze3_all.deb
 6f1be7ed6eb1d4239fd81fc709be37f1ff6b5b2fa6e2e4c5f565805c2c534779 36065476 qt4-doc-html_4.6.3-4+squeeze3_all.deb
Files: 
 171244c83e5a4c45e5bc2239367f511c 3034 libs optional qt4-x11_4.6.3-4+squeeze3.dsc
 87487b3fdd26f694a4df5919fee8452d 390808 libs optional qt4-x11_4.6.3-4+squeeze3.debian.tar.gz
 866ceae5b69e3c2a03bf15d4447126a6 2506888 libs optional libqtcore4_4.6.3-4+squeeze3_amd64.deb
 a092e50885d4c9d8ff3e82bdf8e6bcc4 34770 libs optional libqt4-core_4.6.3-4+squeeze3_amd64.deb
 4987da20a578d65f6746e54a4fe53ee9 5117588 libs optional libqtgui4_4.6.3-4+squeeze3_amd64.deb
 3c0e3fb94f19c42f7ac14ca034195839 34764 libs optional libqt4-gui_4.6.3-4+squeeze3_amd64.deb
 072f2eb29a81f1da02e7e2c9229e427d 542920 libs optional libqt4-network_4.6.3-4+squeeze3_amd64.deb
 903e6abb530f10c88df3524f2150c3d6 330092 libs optional libqt4-opengl_4.6.3-4+squeeze3_amd64.deb
 dfbc65ab589730e01f722cec42ca7a8e 873070 libs optional libqt4-script_4.6.3-4+squeeze3_amd64.deb
 e47907a58b7e233c4a89184d1e0cd526 316652 libs optional libqt4-scripttools_4.6.3-4+squeeze3_amd64.deb
 b532bfa25a2d247c912d3fac0d3f22cc 146436 libs optional libqt4-sql_4.6.3-4+squeeze3_amd64.deb
 ebdf5305a0fd08d7038c5ca9c3e5674a 80206 libs optional libqt4-sql-ibase_4.6.3-4+squeeze3_amd64.deb
 11cc5281984e5d5e0b79422951c6dd1b 63598 libs optional libqt4-sql-mysql_4.6.3-4+squeeze3_amd64.deb
 b23cc0b3896abeff5b896347320114cd 84476 libs optional libqt4-sql-odbc_4.6.3-4+squeeze3_amd64.deb
 3826683840a55f990aaca243ade76c36 66528 libs optional libqt4-sql-psql_4.6.3-4+squeeze3_amd64.deb
 bfdd175afb1eace2f806c746f3e20787 54786 libs optional libqt4-sql-sqlite_4.6.3-4+squeeze3_amd64.deb
 10850646556cd9b8d9aecf01263ae8c2 50646 libs optional libqt4-sql-sqlite2_4.6.3-4+squeeze3_amd64.deb
 7e4bd3b944f8359bcf7c6402bc68a90d 57826 libs optional libqt4-sql-tds_4.6.3-4+squeeze3_amd64.deb
 85ff2f8d60e7c0a519b3690c412a6e5d 205726 libs optional libqt4-svg_4.6.3-4+squeeze3_amd64.deb
 401570e45d36b988beded2586f58ad74 6397284 libs optional libqt4-webkit_4.6.3-4+squeeze3_amd64.deb
 2fd45f01dcf6cfdf5f28c08551d6e516 145424 libs optional libqt4-xml_4.6.3-4+squeeze3_amd64.deb
 c28eaa7dcd6dcd5b33c31ee2358000ce 1560108 libs optional libqt4-xmlpatterns_4.6.3-4+squeeze3_amd64.deb
 93fa4db5a3954a89d1833a7c2c7ffd44 267460 libs optional libqt4-dbus_4.6.3-4+squeeze3_amd64.deb
 b73ab4cf0a456032f2186af456fe5730 1403868 libs optional libqt4-qt3support_4.6.3-4+squeeze3_amd64.deb
 3d0869ed19c36be84947a51c918aeec1 5623008 libs optional libqt4-designer_4.6.3-4+squeeze3_amd64.deb
 71e3cddec21b7b6ec78c93e4f2ed5b0b 263786 libs optional libqt4-help_4.6.3-4+squeeze3_amd64.deb
 a0003f3d4a50f5dde6c6c29e2f2ced0b 46446 libs optional libqt4-assistant_4.6.3-4+squeeze3_amd64.deb
 679a9d8131e0379d0c3178da2e83d928 95772 libs optional libqt4-test_4.6.3-4+squeeze3_amd64.deb
 0902ac840b221f92f41cf0df1beb5465 95832 libs optional libqt4-multimedia_4.6.3-4+squeeze3_amd64.deb
 0638b7f2bbdf5eb4d6986fc92d72c44c 175786 libs optional libqt4-phonon_4.6.3-4+squeeze3_amd64.deb
 d2b30d67338b11d8b48e97a884a8e379 5400934 libdevel optional libqt4-dev_4.6.3-4+squeeze3_amd64.deb
 00f689028703888086f75ec8b39948c2 50226 libdevel optional libqt4-opengl-dev_4.6.3-4+squeeze3_amd64.deb
 7e0c126e7d926606322dbf845957e277 160067198 debug extra libqt4-dbg_4.6.3-4+squeeze3_amd64.deb
 d4f17c31c7fc8275c2b2d674f3d0093d 163050224 debug extra libqt4-webkit-dbg_4.6.3-4+squeeze3_amd64.deb
 058bfeaed7dc7d5eb1c2b3dc48cab57f 22086840 debug extra libqt4-xmlpatterns-dbg_4.6.3-4+squeeze3_amd64.deb
 72d6c263a612edfab801cf93c95f3a32 75979032 debug extra qt4-demos-dbg_4.6.3-4+squeeze3_amd64.deb
 7236d3f5691fddaec095c4d54ef9ee8d 546032 devel optional qt4-designer_4.6.3-4+squeeze3_amd64.deb
 5f79ddbb85647e532a4fc5cb738b9273 5634178 devel optional qt4-dev-tools_4.6.3-4+squeeze3_amd64.deb
 2a67f5b5fe04edcd57c380ed6f3e3189 1629454 devel optional qt4-qmake_4.6.3-4+squeeze3_amd64.deb
 384da90a6b364aca9f0a9c871cccbd61 144368 x11 optional qt4-qtconfig_4.6.3-4+squeeze3_amd64.deb
 7ffabbceaa2c93356ed31419f429b775 13558466 x11 optional qt4-demos_4.6.3-4+squeeze3_amd64.deb
 a57002928d38f9db93aaeb1c557f26d2 67493618 doc optional qt4-doc_4.6.3-4+squeeze3_all.deb
 09589ae7acd90de693830a81296ddc39 36065476 doc optional qt4-doc-html_4.6.3-4+squeeze3_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: Signed by Raphael Hertzog

iQEcBAEBCAAGBQJVQedHAAoJEAOIHavrwpq56FMH/j7v5YkVLRK2EBYWV2Fa2Vgl
7dPGaO4GrNuMQ1zgstG6jn9dEPqmqnTv3paLRGkklc60u1IDO0EPsIuB+ekzt9Bl
kFFW37XnWem7jAdirOJbMERgyavFwvG0nvlBeda3xzIFsyXnkyYNjglEQ/Ev9xXM
u/ZDWi85jOvBXt8urs7nZlUGiUNWJJl5HCpB5UIgb72VS4YmotU9VeVUMW6VJfAE
pReG4AEoB2gao5UDnDuYx1RqDMg11IEkZmgK4xqeqJ02cMkB3AAmYQurDP+tJgp5
pD51X3O9ZlVcB0iIqPxuutrGnxSJihkJIFYv5jENRQMch+JhhBvYImoDcVLCiek=
=e4XN
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.