PT-2014-1913 · Qt Company+2 · Qt+3

Publicado 2014-05-08 · Atualizado 2021-06-16 · CVE-2014-0190

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Qt versions prior to 5.3 QtGui versions prior to 4.8.5-r2

Description The issue concerns a denial of service caused by a NULL pointer dereference in the GIF decoder of QtGui in Qt. This can be triggered by remote attackers sending a GIF image with invalid width and height values. The exploitation of this issue may lead to a disruption in the availability of protected information and can be carried out remotely.

Recommendations For Qt versions prior to 5.3, update to version 5.3 or later to resolve the issue. For QtGui versions prior to 4.8.5-r2, update to version 4.8.5-r2 or later to resolve the issue.

Correção

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2014-1709

ALT-PU-2014-1710

ALT-PU-2014-1711

ALT-PU-2014-1712

ALT-PU-2014-1713

ALT-PU-2014-1714

ALT-PU-2014-1715

ALT-PU-2014-1716

ALT-PU-2014-1717

ALT-PU-2014-1718

ALT-PU-2014-1719

ALT-PU-2014-1720

ALT-PU-2014-1721

ALT-PU-2014-1722

ALT-PU-2014-1725

ALT-PU-2014-1726

BDU:2015-09779

CVE-2014-0190

MGASA-2014-0240

MGASA-2014-0241

MGASA-2014-0263

USN-2626-1

Produtos afetados

Alt Linux

Qt

Qtgui

Ubuntu

Referências · 59

• https://bugs.mageia.org/show_bug.cgi?id=13509 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1860 · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2014-0241 · Aviso do Fabricante
• http://advisories.mageia.org/MGASA-2014-0240.html · Nota
• https://lists.fedoraproject.org/pipermail/package-announce/2014-January/127076.html · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-09779 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0295 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134040.html · Aviso do Fabricante
• http://blog.qt.digia.com/blog/2014/04/24/qt-4-8-6-released · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134141.html · Aviso do Fabricante
• http://lists.qt-project.org/pipermail/announce/2014-April/000045.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-0190 · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2014-0240 · Aviso do Fabricante
• https://errata.altlinux.org/ALT-PU-2014-1718 · Aviso do Fabricante
• http://securityfocus.com/bid/67087 · Nota