PT-2012-1131 · Qt Company+1 · Qt+1

Matthias Weckbecker · Published 2011-09-21 · Updated 2021-06-16 · CVE-2011-3194

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qt versions prior to 4.7.4

Description The issue is related to a buffer overflow in the TIFF reader, which can be triggered by a greyscale TIFF image with multiple samples per pixel, specifically via the TIFFTAG SAMPLESPERPIXEL tag. This can cause a denial of service (crash) and potentially allow the execution of arbitrary code. The vulnerability can be exploited remotely, potentially leading to a breach of confidentiality, integrity, and availability of protected information.

Recommendations For Qt versions prior to 4.7.4, update to version 4.7.4 or later to resolve the issue. As a temporary workaround, consider restricting the handling of TIFF images with multiple samples per pixel to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-09658

CVE-2011-3194

DLA-117-1

RHSA-2011:1323

RHSA-2011:1328

RHSA-2011_1323

RHSA-2011_1328

Affected Products

Qt

Red Hat

References · 33

• http://lists.opensuse.org/opensuse-updates/2011-10/msg00008.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09658 · Security Note
• http://secunia.com/advisories/49383 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07205 · Security Note
• http://rhn.redhat.com/errata/RHSA-2011-1323.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-1323.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2011-1328.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-1328.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201206-02.xml · Vendor Advisory
• http://secunia.com/advisories/49895 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3194 · Security Note
• http://secunia.com/advisories/46371 · Vendor Advisory
• https://hermes.opensuse.org/messages/12056605 · Vendor Advisory
• http://ubuntu.com/usn/USN-1504-1 · Vendor Advisory
• http://secunia.com/advisories/46140 · Vendor Advisory