Two CVEs in qtbase-opensource-src

[Lisandro Damián Nicanor Pérez Meyer]

Hi! Two security bugs where found in qtbase-opensource-src:

https://lists.qt-project.org/pipermail/development/2020-January/038521.html

Issue 1) CVE-2020-0569
Score: 7.3 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
* Vendor: Qt Project
* Product: Qt
* Versions affected: 5.0.0 to 5.13.2
* Versions fixed: 5.14.0 (5.14.1 is currently being prepared in experimental,
  5.14.0 never hit the Debian archive)
* Issue: local attack, loading and execution of untrusted code
* Scope: class QPluginLoader (qtbase/src/corelib/plugin/qpluginloader.cpp)
* Description:
QPluginLoader in Qt versions 5.0.0 through 5.13.2 would search for certain 
plugins first on the current working directory of the application, which 
allows an attacker that can place files in the file system and influence the 
working directory of Qt-based applications to load and execute malicious code. 
This issue was verified on macOS and Linux and probably affects all other Unix 
operating systems. This issue does not affect Windows.


Issue 2) CVE-2020-0570
Score: 7.3 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
* Vendor: Qt Project
* Product: Qt
* Versions affected: 5.12.0 through 5.14.0
* Versions fixed: 5.14.1 (currently being prepared in experimental)
* Issue: local attack, loading and execution of untrusted code
* Scope: class QLibrary (qtbase/src/corelib/plugin)
* Reference: https://bugreports.qt.io/browse/QTBUG-81272
* Description:
QLibrary in Qt versions 5.12.0 through 5.14.0, on certain x86 machines, would 
search for certain libraries and plugins relative to current working directory 
of the application, which allows an attacker that can place files in the file 
system and influence the working directory of Qt-based applications to load 
and execute malicious code. This issue was verified on Linux and probably 
affects all Unix operating systems, other than macOS (Darwin). This issue does 
not affect Windows.

Please noe that the attached debdiff is made againt the current version in
buster p-u, already accepted by SRM.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: debdiff.diff
Type: text/x-diff
Size: 4491 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-kde-talk/attachments/20200130/a7fcd250/attachment.diff>