——————————————————————————–
Fedora Update Notification
FEDORA-2018-0a0da2f3b7
2018-06-09 19:45:50.208325
——————————————————————————–

Name : qt3
Product : Fedora 27
Version : 3.3.8b
Release : 74.fc27
URL : http://www.troll.no
Summary : The shared library for the Qt 3 GUI toolkit
Description :
Qt is a GUI software toolkit which simplifies the task of writing and
maintaining GUI (Graphical User Interface) applications
for the X Window System.

Qt is written in C++ and is fully object-oriented.

This package contains the shared library needed to run Qt 3
applications, as well as the README files for Qt 3.

——————————————————————————–
Update Information:

This update fixes CVE-2016-10040, a stack overflow in QXmlSimpleReader due to a
too lenient entityCharacterLimit in our version of the patch for CVE-2013-4549.
(The limit was increased from the upstream 1024 to 65536 to address QTBUG-35459,
an issue where the security fix was breaking existing real-world XML files.
Unfortunately, that is too much to actually fit on the CPU stack. This fix
decreases the limit to 4096.) It also fixes the QMySql driver to work with the
version of MariaDB in Fedora 27.
——————————————————————————–
ChangeLog:

* Thu May 31 2018 Kevin Kofler <Kevin@tigcc.ticalc.org> – 3.3.8b-74
– Fix CVE-2016-10040 (stack overflow in QXmlSimpleReader due to a too high
entityCharacterLimit in the CVE-2013-4549 patch) (#1409603)
* Fri Feb 9 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> – 3.3.8b-73
– Escape macros in %changelog
* Mon Nov 13 2017 Than Ngo <than@redhat.com> – 3.3.8b-72
– backport mysql driver mariadb fix
– BR: mariadb-connector-c-devel (f28+, #1494085)
——————————————————————————–
References:

[ 1 ] Bug #1409597 – CVE-2016-10040 qt: stack overflow in QXmlSimpleReader
https://bugzilla.redhat.com/show_bug.cgi?id=1409597
——————————————————————————–

This update can be installed with the “dnf” update program. Use
su -c ‘dnf upgrade –advisory FEDORA-2018-0a0da2f3b7’ at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
——————————————————————————–
_______________________________________________
package-announce mailing list — package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O2W3BNHY5P3AWOYWZNGJYDLLXOO52T3C/

——————————————————————————–
Fedora Update Notification
FEDORA-2018-17843a895b
2018-06-09 20:39:22.943416
——————————————————————————–

Name : qt3
Product : Fedora 28
Version : 3.3.8b
Release : 74.fc28
URL : http://www.troll.no
Summary : The shared library for the Qt 3 GUI toolkit
Description :
Qt is a GUI software toolkit which simplifies the task of writing and
maintaining GUI (Graphical User Interface) applications
for the X Window System.

Qt is written in C++ and is fully object-oriented.

This package contains the shared library needed to run Qt 3
applications, as well as the README files for Qt 3.

——————————————————————————–
Update Information:

This update fixes CVE-2016-10040, a stack overflow in QXmlSimpleReader due to a
too lenient entityCharacterLimit in our version of the patch for CVE-2013-4549.
(The limit was increased from the upstream 1024 to 65536 to address QTBUG-35459,
an issue where the security fix was breaking existing real-world XML files.
Unfortunately, that is too much to actually fit on the CPU stack. This fix
decreases the limit to 4096.)
——————————————————————————–
ChangeLog:

* Thu May 31 2018 Kevin Kofler <Kevin@tigcc.ticalc.org> – 3.3.8b-74
– Fix CVE-2016-10040 (stack overflow in QXmlSimpleReader due to a too high
entityCharacterLimit in the CVE-2013-4549 patch) (#1409603)
——————————————————————————–
References:

[ 1 ] Bug #1409597 – CVE-2016-10040 qt: stack overflow in QXmlSimpleReader
https://bugzilla.redhat.com/show_bug.cgi?id=1409597
——————————————————————————–

This update can be installed with the “dnf” update program. Use
su -c ‘dnf upgrade –advisory FEDORA-2018-17843a895b’ at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
——————————————————————————–
_______________________________________________
package-announce mailing list — package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMPQK37WEHT2KHWYTH4WNIAWNFKBUZ3P/