Detections
Analytics

GLSA-200710-28 : Qt: Buffer overflow

high Nessus Plugin ID 27579

Synopsis

The remote Gentoo host is missing one or more security-related patches.

Description

The remote host is affected by the vulnerability described in GLSA-200710-28 (Qt: Buffer overflow)

 Dirk Mueller from the KDE development team discovered a boundary error in file qutfcodec.cpp when processing Unicode strings.
 Impact :

 A remote attacker could send a specially crafted Unicode string to a vulnerable Qt application, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application. Note that the boundary error is present but reported to be not exploitable in 4.x series.
 Workaround :

 There is no known workaround at this time.

Solution

All Qt 3.x users should upgrade to the latest version:
 # emerge --sync # emerge --ask --oneshot --verbose '>=x11-libs/qt-3.3.8-r4'

See Also

https://security.gentoo.org/glsa/200710-28

Plugin Details

Severity: High

ID: 27579

File Name: gentoo_GLSA-200710-28.nasl

Version: 1.15

Type: local

Published: 10/26/2007

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.5

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/o:gentoo:linux, p-cpe:/a:gentoo:linux:qt

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Patch Publication Date: 10/25/2007

Reference Information

CVE: CVE-2007-4137

CWE: 119

GLSA: 200710-28