qt security update

ID CESA-2007:0883-01
Type centos
Reporter CentOS Project
Modified 2007-09-14T01:30:43


CentOS Errata and Security Advisory CESA-2007:0883-01

Qt is a software toolkit that simplifies the task of writing and maintaining GUI (Graphical User Interface) applications for the X Window System.

A flaw was found in the way Qt expanded certain UTF8 characters. It was possible to prevent a Qt-based application from properly sanitizing user supplied input. This could, for example, result in a cross-site scripting attack against the Konqueror web browser. (CVE-2007-0242)

A buffer overflow flaw was found in the way Qt expanded malformed Unicode strings. If an application linked against Qt parsed a malicious Unicode string, it could lead to a denial of service or possibly allow the execution of arbitrary code. (CVE-2007-4137)

Users of Qt should upgrade to these updated packages, which contain a backported patch to correct these issues.

Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-announce/2007-September/014198.html

Affected packages: qt qt-Xt qt-designer qt-devel qt-static

Upstream details at: https://rhn.redhat.com/errata/rh21as-errata.html