PT-2018-2543 · Qt Company+5 · Qt+5

Published 2018-12-06 · Updated 2025-02-11 · CVE-2018-19873

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qt versions prior to 5.11.3

Description The issue is related to a buffer overflow in the QBmpHandler class of the Qt cross-platform framework, which can be exploited via BMP data. This could allow a remote attacker to cause a denial of service or gain unauthorized access to information.

Recommendations For Qt versions prior to 5.11.3, update to version 5.11.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of BMP data in the QBmpHandler class until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2018-2887

ALT-PU-2018-2888

ALT-PU-2018-2889

ALT-PU-2018-2890

ALT-PU-2018-2891

ALT-PU-2018-2892

ALT-PU-2018-2893

ALT-PU-2018-2894

ALT-PU-2018-2895

ALT-PU-2018-2896

ALT-PU-2018-2897

ALT-PU-2018-2898

ALT-PU-2018-2899

ALT-PU-2018-2900

ALT-PU-2018-2901

ALT-PU-2018-2902

ALT-PU-2018-2903

ALT-PU-2018-2904

ALT-PU-2018-2905

ALT-PU-2018-2906

ALT-PU-2018-2907

ALT-PU-2018-2908

ALT-PU-2018-2909

ALT-PU-2018-2910

ALT-PU-2018-2911

ALT-PU-2018-2912

ALT-PU-2018-2913

ALT-PU-2018-2914

ALT-PU-2018-2915

ALT-PU-2018-2916

ALT-PU-2018-2917

ALT-PU-2019-2558

ALT-PU-2019-2583

BDU:2019-00951

CESA-2019_2135

CESA-2019_3390

CESA-2020_1172

CVE-2018-19873

DLA-1627-1

DLA-1786-1

DLA-2377-1

DSA-4374-1

MGASA-2019-0025

MGASA-2020-0204

OPENSUSE-SU-2018_4261-1

OPENSUSE-SU-2019:0265-1

OPENSUSE-SU-2019_0265-1

OPENSUSE-SU-2020:1452-1

OPENSUSE-SU-2020:1500-1

OPENSUSE-SU-2020:1501-1

OPENSUSE-SU-2020:1530-1

OPENSUSE-SU-2020_1452-1

OPENSUSE-SU-2020_1501-1

RHSA-2019:2135

RHSA-2019:3390

RHSA-2019_2135

RHSA-2019_3390

RHSA-2020:1172

RHSA-2020_1172

SUSE-SU-2018:4179-1

SUSE-SU-2018:4183-1

SUSE-SU-2018:4210-1

SUSE-SU-2018:4210-2

SUSE-SU-2018:4294-1

SUSE-SU-2019:0447-1

SUSE-SU-2020:1021-1

USN-4003-1

Affected Products

Alt Linux

Centos

Qt

Red Hat

Suse

Ubuntu

References · 254

• https://osv.dev/vulnerability/SUSE-SU-2018:4183-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00073.html · Vendor Advisory
• https://codereview.qt-project.org/#/c/238749 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2018-2906 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-19873 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2019-2135.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00922 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-19873 · Security Note
• https://errata.altlinux.org/ALT-PU-2018-2901 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=41192827 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03458 · Security Note
• https://osv.dev/vulnerability/DSA-4374-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2018-2909 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-1172.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-4374-1 · Vendor Advisory