QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values.
An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.
An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed..
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.
In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length.
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion.
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When a SVG file with an image inside it is rendered, a QTextLayout buffer overflow can be triggered.
Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3.
Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).
Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1 is not affected, regardless of the Qt version.)
In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service (memory consumption).
Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue to CVE-2003-1564.
The named pipes in qtsingleapp in Qt 5.x, as used in qBittorrent and SugarSync, are configured for remote access and allow remote attackers to cause a denial of service (application crash) via an unspecified string.
Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potentially enable elevation of privilege via local access.
In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled.
An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file.
encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).
Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated user to potentially enable denial of service via local access.
An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupted font is loaded via QFontDatabase::addApplicationFont{FromData], then it can cause the application to crash because of missing length checks.
An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match.
An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. QDnsLookup has a buffer over-read via a crafted reply from a DNS server.
An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buffer over-read.
VuXML only (0) · listed, port not fixed yet
None. pkg audit reports nothing for this version.
Fixed (0)
No VuXML entries for this package.
Commits (22)
Gleb Popov (arrowd) · 5.12.2
*: Fix spelling and typos in comments and pkg-descr's of various ports
Pull Request: https://github.com/freebsd/freebsd-ports/pull/506
Co-authored-by: Gleb Popov <arrowd@FreeBSD.org>
Add missing WWW entries
These ports reference the pkg-descr file of some other port and used
to get the WWW entry from that other port's file.
Reported by: dan@langille.org (Dan Langille)
Qt: Switch Qt5 to use KDE's Qt patch collection
From [1]
What's this?
This is a set of git repositories based on the last public
commits available for Qt 5.15 branches with a curated collection
of patches on top to ensure open source products can be used
comfortably until users transition to their Qt 6-based ports.
Which patches does it include?
This collection of patches includes patches that fix at least
one of the following:
* Security issues
* Crashes
* Functional defects
We only include patches that have been approved upstream in the
Qt project. If a patch cannot be merged upstream for technical
reasons (e.g. the class no longer exists), it can also be
merged.
The patches to merge will be decided based on their relevance
towards Open Source products and their viability.
PR: 260548
Exp-run by: antoine
Differential Revision: https://reviews.freebsd.org/D33446
[1] https://community.kde.org/Qt5PatchCollection
Qt5 update to 5.13.0
For new features, check: https://wiki.qt.io/New_Features_in_Qt_5.13
Thanks to adridg who helped to fix a lot of packages.
Exp-run by: antoine
PR: 238782
Update Qt5 to 5.12.1
Release announcement:
https://blog.qt.io/blog/2019/02/01/qt-5-12-1-released/
Changelog:
https://wiki.qt.io/Qt_5.12.1_Change_Files
- A change was required to qt-dist.mk to always pass LOCALBASE to qmake,
as Qt5 has been installed to a prefix for some time now, there should
not be any harm in that, with respect to it picking up installed versions
of itself during build.
PR: 235622
Exp-run by: antoine
Update Qt5 to 5.12.0
http://blog.qt.io/blog/2018/12/06/qt-5-12-lts-released/
- This breaks support for libressl again. Patches are welcome.
PR: 233705
Exp-run by: antoine
Update Qt5 to 5.11.1
Big thanks to
* brnrd for the libressl patches in net/qt5-network
* jhale for fixing the bulk load of ports
PR: 230884
Exp-run by: antoine
Replace bsd.qt.mk by Uses/qt.mk and Uses/qt-dist.mk
From now on, ports that depend on Qt4 will have to set
USES= qt:4
USE_QT= foo bar
ports depending on Qt5 will use
USES= qt:5
USE_QT= foo bar
PR: 229225
Exp-run by: antoine
Reviewed by: mat
Approved by: portmgr (antoine)
Differential Revision: →https://reviews.freebsd.org/D15540
Update the Qt5 ports to 5.10.1.
The work was done by tcberner and myself, with thanks to antoine for the
exp-run.
Not a lot to report compared to other Qt5 updates:
* net/qt5-network is still broken with LibreSSL. I said this in a commit
message ages ago but it bears repeating: upstream is open to adding support
for LibreSSL, but someone needs to step up to maintain it upstream, otherwise
things will continue to be broken all the time.
* www/qt5-webengine is a huge monster that is terrible to update, just like
www/chromium itself is. We (kde@) have decided to keep using the 5.9 series
for the time being, as it should be compatible with the rest of Qt anyway. It
was updated to 5.9.5, the latest 5.9 release at the time of writing.
PR: 228213
Fix permissions in installed Qt5 header files
For the qt5-* ports bsd.qt.mk sets EXTRACT_AFTER_ARGS, and
thereby does not get the normal default value of
--no-same-owner --no-same-permissions
passed when extracting. This lead to for example header files
being installed (i.e. copied), with permissions group write
permissions.
Manually append that to the bsd.qt.mk shenanigans (also do the
same in www/qt5-webchannel, which opts out of the bsd.qt.mk value)
PR: 227027
Reported by: grarpamp@gmail.com
Update Qt5 to 5.9.4.
Announcement:
https://blog.qt.io/blog/2018/01/23/qt-5-9-4-released/
This is a minor update and a lot easier to land than the previous 5.7.1 ->
5.9.3 commit.
Thanks to antoine for the exp-run.
PR: 225436
Update Qt5 ports to 5.9.3.
This took quite a lot of time because Qt's own build system underwent
several changes in 5.8.0 that took a while to adapt to.
And, of course, qt5-webengine is a behemoth that we need to patch like crazy
due to its bundling of Chromium. In fact, most of the Chromium patches in
qt5-webengine have been imported with no changes from www/chromium@433510
("www/chromium: update to 56.0.2924.87").
New port: accessibility/qt5-speech
Bigger changes to Qt5 ports we had to make:
- Qt now allows using a configure.json file to define configuration options
and specify configuration checks that can be done when qmake is invoked.
However, configure.json checks done in a subdirectory only propagates to
subdirectories, and checks elsewhere will fail if all .pro files are being
parsed at once (i.e. qmake -recursive), so several ports had to switch to
USES=qmake:norecursive along with manual additional qmake invocations in
subdirectories in order to work. It's been mentioned in a few places such
as Qt's bug tracker that qmake's recursive mode is pretty much deprecated,
so we might switch to non-recursive mode by default in the future.
- Uses/qmake.mk: Introduce QMAKE_CONFIGURE_ARGS. qmake now accepts
arbitrary options such as '-foo' and '-no-bar' at the end of the
command-line. They can be specified in QMAKE_CONFIGURE_ARGS.
- graphics/qt5-wayland: The port can only be built if graphics/mesa-libs is
built with the WAYLAND option, so a corresponding option (off by default)
was added to the port.
- misc/qt5-doc: Switch to a pre-built documentation tarball. The existing
port was not working with Qt 5.9. Instead of trying to fix it, switch to
what Gentoo does and fetch a tarball that already contains all
documentation so that we do not have to build anything at all. The
tarball's name and location in download.qt.io look a bit weird, but it
seems to work fine.
- www/qt5-webengine: Use binutils from ports, Chromium's GN build system
generates a build.ninja that uses ar(1) with the @file syntax that is not
supported by BSD ar, so we need to use GNU ar from binutils.
- x11-toolkits/qt5-declarative-render2d: This port was merged into the main
Qt Declarative repository upstream, and into x11-toolkits/qt5-quick in the
ports tree.
Changes to other ports we had to make:
- biology/ugene: Drop a '#define point "."' that is not present in more
recent versions of the port. Defining a macro with such a common name
causes build issues with Qt 5.9, which uses |point| as an argument name in
methods.
- cad/qelectrotech: Fix plist with Qt 5.9. Directories are no longer
installed with `cp -f -R', but rather `qmake install qinstall', which does
not install
%%DATADIR%%/elements/10_electric/20_manufacturers_articles/bosch_rexroth/.directory
That's a local file that should not even have been part of the tarball
anyway.
- chinese/gcin-qt5: Add additional private Qt directories (which should not
be used in the first place) to get the port to build with Qt 5.9.
- devel/qtcreator: Fix plist with Qt 5.9. Something changed in qdoc and some
test classes no longer generate documentation files.
- security/keepassx-devel: Import a patch sent upstream almost a year ago to
fix the build with Qt 5.9.
Thanks to antoine for the exp-run, and tcberner and Laurent Cimon
<laurent@nuxi.ca> for landing changes in our qt-5.9 branch.
PR: 224849
Update Qt5 to 5.7.1, and unify the Qt4 and Qt5 ports some more
* Update Qt5 to 5.7.1
* Move Qt4 binaries to lib/qt4/bin
* Move Qt5 libraries to lib/qt5/lib
By moving the libraries we should finally be able to get rid of the inplace
upgrade bug (see ports bugs 194088, 195105 and 198720): when Qt5's libraries
were lying in /usr/local/lib, which would often get added by pkgconfig to the
linker paths via dependencies, the already installed libraries were linked
against, instead of the ones that were being built. This forced us to make
sure, that -L${WRKSRC}/lib was always coming before -L/usr/local/lib in the
linker flags. With this change this should no longer be the case.
* Rename some ports to match the rest (foo-qtX -> qtX-foo)
* Depend on new port misc/qtchooser [see UPDATING & CHANGES]
There are several new Qt5 ports which all have been created by Marie Loise Nolden
<nolden@kde.org>. Thanks again.
PR: 216797
Exp-Run by: antoine
Reviewed by: rakuco, mat, groot_kde.org
Approved by: rakuco (mentor)
Differential Revision: https://reviews.freebsd.org/D9213
Update Qt to 5.6.2 [1,2]
Thanks to the upstream work of Marie Loise Nolden, we could get rid of a handful
of patches, as they have been properly upstreamed. The rest of the work is just
some minor plist changes.
I would like to thank Loise <nolden@kde.org> for the upstream work, and Adriaan
<groot@kde.org> for getting the update into shape.
[1] http://blog.qt.io/blog/2016/10/12/qt-5-6-2-released/
[2] http://wiki.qt.io/Qt_5.6.2_Change_Files
PR: 213530
Exp-run by: antoine
Submitted by: Adriaan de Groot <groot@kde.org>
Reviewed by: rakuco, mat, tcberner
Approved by: rakuco (mentor)
Differential Revision: https://reviews.freebsd.org/D8228
Update the Qt5 ports to 5.6.1.
This took longer than expected, but there are quite a few changes to the
existing ports and a few new ones.
General upstream changes:
- Starting with Qt 5.6.2, Qt will fail at configuration time if LibreSSL is
being used. According to the discussion here:
https://codereview.qt-project.org/#/c/154800/
The Qt project is not opposed to LibreSSL, but does not want to mix
support for it into the OpenSSL backend code, especially as they move
towards supporting OpenSSL 1.1.
People interested in LibreSSL support are welcome to submit a separate
backend upstream, but are expected to maintain it. We (kde@) are not
opposed to carrying some patches authored by others in the future, as long
as they are not huge and destabilizing.
- When Qt detects the compiler supports C++11, it will pass -std=gnu++11 by
default (this is an upstream change). You can add "CONFIG -= c++11" to
your .pro. Qt 5.7 will require C++11.
- www/webkit-qt5: The QtWebKit module is deprecated upstream, and is shipped
separately as a community release tarball. kde@ does not have an ETA for a
qt5-webengine port, as it requires a huge effort (and number of patches)
similar to maintaining www/chromium itself.
- x11-toolkits/qt5-declarative has been deprecated upstream. The last
release is 5.5.1.
Relevant changes:
- devel/qmake5: The freebsd-clang mkspec has become the default mkspec on
FreeBSD, replacing the outdated freebsd-g++ one that was moved to
unsupported/ (it still works though).
- devel/qt5-qdoc: qdoc was moved to qttools upstream, but its data files are
still in qtbase. The data files are now in the qt5-qdoc-data port.
- misc/qt5-doc: Clean up and stop requiring a compiler and fumbling with
mkspecs. Instead of running the `configure' script, which requires a
compiler and adjustments to the mkspecs files and also ends up building a
new qmake binary, we now leverage USES=qmake to generate all the Makefiles
from the top-level qt.pro. Getting this to work requires some tricks,
though, and qt.conf.in has a longer explanation of what's being done.
Switch to USES=gmake to be able to drop MAKE_JOBS_UNSAFE=yes.
New ports:
- comms/qt5-serialbus
- devel/qt5-qdoc-data
- x11-toolkits/qt5-quickcontrols2
Big thanks to Adriaan de Groot (groot@kde.org), tcberner@ and Loise Nolden
(nolden@kde.org) for the huge amount of work they put into this
patch. Loise in particular also sent quite a few changes upstream that were
essential for this update to work.
PR: 211916
New port: misc/qt5-doc
This port builds and installs the Qt5 API documentation for use
with IDEs such as qtcreator or kdevelop in qch file format and HTML
file format.
Limitations: The port is made for Qt 5.5.1 and excludes the
documentation for qtwebkit, qtwebkit-examples and qtwebengine. The
reasons are, webkit is deprecated and should not be used for further
development, it will not be part of the Qt 5.6.x sources by default
and only provided on FreeBSD for backwards compatibility with ports.
API documentation may be later added to the qt5-webkit port (as
well for qtwebkit-examples). The qtwebengine hasn't been ported to
FreeBSD yet, so no documenation can be generated either.
The build process uses the full qt source tarball and uses configure
with the respective platform (freebsd-g++ or freebsd-clang). During
configure, the qmake tool is compiled that generates the Makefiles
for doc creation. While the qt5-qmake could also be used, it currently
generates the documentation without the correct links and replaces
them with text, which makes the API documentation useless with
respect to the workflow. The compiling of qmake has been accepted
for now as a minor drawback of the port.
PR: 209861
Submitted by: Ralf Nolden <nolden@kde.org> (kde)