blob: 8db1bf579f40d8580252326b6b00226bce57af78 [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200509-18">
<title>Qt: Buffer overflow in the included zlib library</title>
Qt is vulnerable to a buffer overflow which could potentially lead to the
execution of arbitrary code.
<product type="ebuild">qt</product>
<announced>September 26, 2005</announced>
<revised>September 26, 2005: 02</revised>
<package name="x11-libs/qt" auto="yes" arch="*">
<unaffected range="ge">3.3.4-r8</unaffected>
<vulnerable range="lt">3.3.4-r8</vulnerable>
Qt is a cross-platform GUI toolkit used by KDE.
Qt links to a bundled vulnerable version of zlib when emerged with the
zlib USE-flag disabled. This may lead to a buffer overflow.
<impact type="normal">
By creating a specially crafted compressed data stream, attackers can
overwrite data structures for applications that use Qt, resulting in a
Denial of Service or potentially arbitrary code execution.
Emerge Qt with the zlib USE-flag enabled.
All Qt users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=x11-libs/qt-3.3.4-r8&quot;</code>
<uri link="/security/en/glsa/glsa-200507-05.xml">GLSA 200507-05</uri>
<uri link="/security/en/glsa/glsa-200507-19.xml">GLSA 200507-19</uri>
<uri link="">CAN-2005-1849</uri>
<uri link="">CAN-2005-2096</uri>
<metadata tag="submitter" timestamp="Thu, 22 Sep 2005 16:49:17 +0000">
<metadata tag="bugReady" timestamp="Fri, 23 Sep 2005 12:32:05 +0000">