diff --git a/desktop/toolkit/qt5/qt5-quickcontrols2/pspec.xml b/desktop/toolkit/qt5/qt5-quickcontrols2/pspec.xml
index af5a4fbd18..643d841f8d 100755
--- a/desktop/toolkit/qt5/qt5-quickcontrols2/pspec.xml
+++ b/desktop/toolkit/qt5/qt5-quickcontrols2/pspec.xml
@@ -11,14 +11,14 @@
Next generation user interface controls based on Qt Quick
Next generation user interface controls based on Qt Quick
LGPLv2.1-linking-exception
- http://download.qt.io/official_releases/qt/5.13/5.13.1/submodules/qtquickcontrols2-everywhere-src-5.13.1.tar.xz
+ http://download.qt.io/official_releases/qt/5.13/5.13.2/submodules/qtquickcontrols2-everywhere-src-5.13.2.tar.xz
- qt5-base-devel
- qt5-declarative-devel
- qt5-xmlpatterns-devel
- qt5-graphicaleffects
- qt5-assistant-devel
- qt5-sql-sqlite
+ qt5-base-devel
+ qt5-declarative-devel
+ qt5-xmlpatterns-devel
+ qt5-graphicaleffects
+ qt5-assistant-devel
+ qt5-sql-sqlite
@@ -26,8 +26,8 @@
qt5-quickcontrols2
libgcc
- qt5-base
- qt5-declarative
+ qt5-base
+ qt5-declarative
/usr/lib
@@ -40,7 +40,7 @@
qt5-quickcontrols2-devel
qt5-quickcontrols2
- qt5-base-devel
+ qt5-base-devel
/usr/include
@@ -51,7 +51,7 @@
qt5-quickcontrols2-docs
- qt5-base
+ qt5-base
/usr/share/doc
@@ -59,6 +59,13 @@
+
+ 2019-11-02
+ 5.13.2
+ Version bump.
+ Mustafa Cinasal
+ muscnsl@gmail.com
+
2019-09-05
5.13.1
diff --git a/desktop/toolkit/qt5/qt5-webengine/files/CVE-2019-13720.patch b/desktop/toolkit/qt5/qt5-webengine/files/CVE-2019-13720.patch
new file mode 100644
index 0000000000..c3440ede56
--- /dev/null
+++ b/desktop/toolkit/qt5/qt5-webengine/files/CVE-2019-13720.patch
@@ -0,0 +1,55 @@
+From d6e5fc10e417efdf8665d9fba57c269f0534072f Mon Sep 17 00:00:00 2001
+From: Allan Sandfeld Jensen
+Date: Fri, 1 Nov 2019 11:10:31 +0100
+Subject: [Backport] Fix for CVE-2019-13720
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Obtain graph/process lock when nullifying the buffer in Reverb
+
+When the buffer is set to `null` while there is an active buffer
+within a reverb object, SetBuffer() function can prematurely
+nullify the `reverb_` and `shared_buffer_` while it is still
+being accessed by the rendering thread.
+
+This CL adds two locks (graph lock and process lock) when the
+buffer gets nullified to ensure the synchronization between
+two threads.
+
+(cherry picked from commit 6a2e670a243b815cf043f8da4d26ecb9a64d307b)
+
+Change-Id: I8f501b6a16b3c7e16db767e0b279a1a53d6eb290
+Bug: 1019226
+Reviewed-on:
+https://chromium-review.googlesource.com/c/chromium/src/+/1888103
+Commit-Queue: Hongchan Choi
+Reviewed-by: Robert Sesek
+Cr-Original-Commit-Position: refs/heads/master@{#710627}
+Reviewed-on:
+https://chromium-review.googlesource.com/c/chromium/src/+/1889510
+Reviewed-by: Krishna Govind
+Cr-Commit-Position: refs/branch-heads/3953@{#8}
+Cr-Branched-From:
+b5ceb94d4b9a2f629c84df1be72f9e3d0a79fd2d-refs/heads/master@{#710313}
+Reviewed-by: Michael BrĂ¼ning
+---
+ chromium/third_party/blink/renderer/modules/webaudio/convolver_node.cc | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/3rdparty/chromium/third_party/blink/renderer/modules/webaudio/convolver_node.cc b/src/3rdparty/chromium/third_party/blink/renderer/modules/webaudio/convolver_node.cc
+index a0c05beab71..066ed521d09 100644
+--- a/src/3rdparty/chromium/third_party/blink/renderer/modules/webaudio/convolver_node.cc
++++ b/src/3rdparty/chromium/third_party/blink/renderer/modules/webaudio/convolver_node.cc
+@@ -95,6 +95,8 @@ void ConvolverHandler::SetBuffer(AudioBuffer* buffer,
+ DCHECK(IsMainThread());
+
+ if (!buffer) {
++ BaseAudioContext::GraphAutoLocker context_locker(Context());
++ MutexLocker locker(process_lock_);
+ reverb_.reset();
+ buffer_ = buffer;
+ return;
+--
+cgit v1.2.1
+
diff --git a/desktop/toolkit/qt5/qt5-webengine/pspec.xml b/desktop/toolkit/qt5/qt5-webengine/pspec.xml
index 9c212c19ec..1f91e36be5 100755
--- a/desktop/toolkit/qt5/qt5-webengine/pspec.xml
+++ b/desktop/toolkit/qt5/qt5-webengine/pspec.xml
@@ -11,15 +11,15 @@
Provides support for web applications using the Chromium browser project
Provides support for web applications using the Chromium browser project
LGPLv2.1-linking-exception
- http://download.qt.io/official_releases/qt/5.13/5.13.1/submodules/qtwebengine-everywhere-src-5.13.1.tar.xz
+ http://download.qt.io/official_releases/qt/5.13/5.13.2/submodules/qtwebengine-everywhere-src-5.13.2.tar.xz
- qt5-base-devel
- qt5-declarative-devel
- qt5-xmlpatterns-devel
- qt5-location-devel
- qt5-sensors-devel
- qt5-webchannel-devel
- qt5-designer-devel
+ qt5-base-devel
+ qt5-declarative-devel
+ qt5-xmlpatterns-devel
+ qt5-location-devel
+ qt5-sensors-devel
+ qt5-webchannel-devel
+ qt5-designer-devel
bison
re2-devel
re2c
@@ -75,7 +75,7 @@
poppler-cpp-devel
- qtbug-77037-workaround.patch
+ CVE-2019-13720.patch
@@ -115,7 +115,7 @@
libopus
libxml2
libvpx
- qt5-base
+ qt5-base
alsa-lib
harfbuzz
libevent
@@ -125,11 +125,11 @@
libXScrnSaver
libXdamage
libXrender
- qt5-location
+ qt5-location
libXcomposite
libjpeg-turbo
- qt5-webchannel
- qt5-declarative
+ qt5-webchannel
+ qt5-declarative
zlib
minizip
protobuf
@@ -146,17 +146,17 @@
qt5-webengine
- qt5-base-devel
- qt5-declarative-devel
- qt5-location-devel
- qt5-webchannel-devel
+ qt5-base-devel
+ qt5-declarative-devel
+ qt5-location-devel
+ qt5-webchannel-devel
qt5-webengine-docs
- qt5-base
+ qt5-base
/usr/share/doc
@@ -164,6 +164,13 @@
+
+ 2019-11-02
+ 5.13.2
+ Version bump.
+ Mustafa Cinasal
+ muscnsl@gmail.com
+
2019-09-26
5.13.1
diff --git a/desktop/toolkit/qt5/qt5-webkit/pspec.xml b/desktop/toolkit/qt5/qt5-webkit/pspec.xml
index d9378c1a57..fc28664a81 100755
--- a/desktop/toolkit/qt5/qt5-webkit/pspec.xml
+++ b/desktop/toolkit/qt5/qt5-webkit/pspec.xml
@@ -13,17 +13,17 @@
LGPLv2.1-linking-exception
https://github.com/annulen/webkit/releases/download/qtwebkit-5.212.0-alpha3/qtwebkit-5.212.0-alpha3.tar.xz
- qt5-base-devel
- qt5-sensors-devel
- qt5-location-devel
- qt5-declarative-devel
- qt5-webchannel-devel
- qt5-designer-devel
- qt5-linguist
- qt5-qdbusviewer
- qt5-multimedia-devel
- qt5-assistant-devel
- qt5-sql-sqlite
+ qt5-base-devel
+ qt5-sensors-devel
+ qt5-location-devel
+ qt5-declarative-devel
+ qt5-webchannel-devel
+ qt5-designer-devel
+ qt5-linguist
+ qt5-qdbusviewer
+ qt5-multimedia-devel
+ qt5-assistant-devel
+ qt5-sql-sqlite
mesa-devel
cmake
libXtst-devel
@@ -79,7 +79,7 @@
/usr/share/doc
- qt5-base
+ qt5-base
mesa
webp
zlib
@@ -92,16 +92,16 @@
libxml2
libxslt
libXrender
- qt5-sensors
- qt5-webchannel
+ qt5-sensors
+ qt5-webchannel
libXcomposite
libjpeg-turbo
gstreamer
gstreamer
gst-plugins-base
gst-plugins-base
- qt5-location
- qt5-declarative
+ qt5-location
+ qt5-declarative
@@ -113,7 +113,7 @@
qt5-webkit
- qt5-base-devel
+ qt5-base-devel
mesa-devel
webp-devel
zlib-devel
@@ -125,16 +125,23 @@
libxml2-devel
libxslt-devel
libXrender-devel
- qt5-sensors-devel
+ qt5-sensors-devel
libXcomposite-devel
libjpeg-turbo-devel
gstreamer-devel
gst-plugins-base-devel
- qt5-declarative-devel
+ qt5-declarative-devel
+
+ 2019-11-02
+ 5.212.0
+ Rebuild.
+ Mustafa Cinasal
+ muscnsl@gmail.com
+
2019-09-05
5.212.0