QT off by one buffer overflow

🗓️ 13 Sep 2007 16:15:00Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 2 Views

Off-by-one buffer overflow in Qt 3 QUtf8Decoder::toUnicode causes a crash; Qt 4 is not exploitable.

Reporter	Title	Published	Views	Family All 97
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	2.1	i386	qt	1:2.3.1-14.EL2	qt-1:2.3.1-14.EL2.i386.rpm
Red Hat Enterprise Linux	2.1	ia64	qt	1:2.3.1-14.EL2	qt-1:2.3.1-14.EL2.ia64.rpm
Red Hat Enterprise Linux	3	i386	qt	1:3.1.2-17.RHEL3	qt-1:3.1.2-17.RHEL3.i386.rpm
Red Hat Enterprise Linux	3	ia64	qt	1:3.1.2-17.RHEL3	qt-1:3.1.2-17.RHEL3.ia64.rpm
Red Hat Enterprise Linux	3	ppc	qt	1:3.1.2-17.RHEL3	qt-1:3.1.2-17.RHEL3.ppc.rpm
Red Hat Enterprise Linux	3	ppc64	qt	1:3.1.2-17.RHEL3	qt-1:3.1.2-17.RHEL3.ppc64.rpm
Red Hat Enterprise Linux	3	s390	qt	1:3.1.2-17.RHEL3	qt-1:3.1.2-17.RHEL3.s390.rpm
Red Hat Enterprise Linux	3	s390x	qt	1:3.1.2-17.RHEL3	qt-1:3.1.2-17.RHEL3.s390x.rpm
Red Hat Enterprise Linux	3	x86_64	qt	1:3.1.2-17.RHEL3	qt-1:3.1.2-17.RHEL3.x86_64.rpm
Red Hat Enterprise Linux	4	i386	qt	1:3.3.3-13.RHEL4	qt-1:3.3.3-13.RHEL4.i386.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2007-4137
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2007-4137
cve	www.cve.org/CVERecord

21 Nov 2025 17:32Current

6.1Medium risk

Vulners AI Score6.1

CVSS 27.5

EPSS0.02359

qt framework buffer overflow utf eight unicode decoding denial of service heap overflow