Qt Buffer Overflow in QUtf8Decoder May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1018688
|
|
SecurityTracker URL: http://securitytracker.com/id?1018688
|
|
CVE Reference: CVE-2007-4137
(Links to External Site)
|
Date: Sep 13 2007
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 3, 4
|
Description: A vulnerability was reported in Qt. A remote user can execute arbitrary code on the target system.
A remote user can send specially crafted UTF-8 encoded data to an application using Qt to trigger a one-byte buffer overflow and
potentially execute arbitrary code on the target system. The code will run with the privileges of the target application or service.
Dirk
Mueller of KDE reported this vulnerability.
|
Impact: A remote user can execute arbitrary code on the target system.
|
Solution: The vendor has issued patches.
For Qt 3:
http://www.trolltech.com/developer/download/175791_3.diff
For Qt 4:
http://www.trolltech.com/developer/download/175791
_4.diff
The fix will be included in the next maintenance release of Qt 4.
The vendor's advisory is available at:
http://trolltech.com/company/newsroom/announceme
nts/press.2007-09-03.7564032119
|
Vendor URL: trolltech.com/company/newsroom/announcements/press.2007-09-03.7564032119 (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Thu, 13 Sep 2007 17:03:44 -0400
Subject: Qt
|
http://www.blogistan.co.uk/qt/2007/09/trolltech_issues_security_patc.php
CVE-2007-4137
|
|
