9.3 - GLSA-201206-02

Executive Summary

Summary
Title	QtGui: User-assisted execution of arbitrary code

Informations
Name	GLSA-201206-02	First vendor Publication	2012-06-03
Vendor	Gentoo	Last vendor Modification	2012-06-03
Severity (Vendor)	Normal	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

A buffer overflow in QtGui could result in execution of arbitrary code or Denial of Service.

Background

QtGui is a module for the Qt toolkit.

Description

An error in qtiffhandler.cpp could cause a buffer overflow.

Impact

A remote attacker could entice a user to open a specially crafted TIFF image with an application linked against QtGui, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All QtGui users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-libs/qt-gui-4.7.4-r1"

Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.

References

[ 1 ] CVE-2011-3194 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3194

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201206-02.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-201206-02.xml

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:17910

Oval ID:	oval:org.mitre.oval:def:17910
Title:	USN-1504-1 -- qt4-x11 vulnerabilities
Description:	Qt Applications could be made to crash or run programs as your login if they opened specially crafted files.
Family:	unix	Class:	patch
Reference(s):	USN-1504-1 CVE-2010-5076 CVE-2011-3193 CVE-2011-3194	Version:	5
Platform(s):	Ubuntu 11.04 Ubuntu 10.04	Product(s):	qt4-x11
Definition Synopsis:
Release section Ubuntu 11.04 is installed Packages match section libqt4-network DPKG is earlier than 4:4.7.2-0ubuntu6.4 AND libqtgui4 DPKG is earlier than 4:4.7.2-0ubuntu6.4 AND Release section Ubuntu 10.04 is installed Packages match section libqt4-network DPKG is earlier than 4:4.6.2-0ubuntu5.4 AND libqtgui4 DPKG is earlier than 4:4.6.2-0ubuntu5.4

Definition Id: oval:org.mitre.oval:def:22085

Oval ID:	oval:org.mitre.oval:def:22085
Title:	RHSA-2011:1323: qt security update (Moderate)
Description:	Buffer overflow in the TIFF reader in gui/image/qtiffhandler.cpp in Qt 4.7.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the TIFFTAG_SAMPLESPERPIXEL tag in a greyscale TIFF image with multiple samples per pixel.
Family:	unix	Class:	patch
Reference(s):	RHSA-2011:1323-01 CVE-2011-3193 CVE-2011-3194	Version:	29
Platform(s):	Red Hat Enterprise Linux 6	Product(s):	qt
Definition Synopsis:
The operating system installed on the system is Red Hat Enterprise Linux 6 Packages section qt-demos is earlier than 1:4.6.2-17.el6_1.1 AND qt-odbc is earlier than 1:4.6.2-17.el6_1.1 AND qt-mysql is earlier than 1:4.6.2-17.el6_1.1 AND qt-doc is earlier than 1:4.6.2-17.el6_1.1 AND qt-x11 is earlier than 1:4.6.2-17.el6_1.1 AND phonon-backend-gstreamer is earlier than 1:4.6.2-17.el6_1.1 AND qt-postgresql is earlier than 1:4.6.2-17.el6_1.1 AND qt-sqlite is earlier than 1:4.6.2-17.el6_1.1 AND qt is earlier than 1:4.6.2-17.el6_1.1 AND qt-examples is earlier than 1:4.6.2-17.el6_1.1 AND qt-devel is earlier than 1:4.6.2-17.el6_1.1

Definition Id: oval:org.mitre.oval:def:22129

Oval ID:	oval:org.mitre.oval:def:22129
Title:	RHSA-2011:1328: qt security update (Moderate)
Description:	Buffer overflow in the TIFF reader in gui/image/qtiffhandler.cpp in Qt 4.7.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the TIFFTAG_SAMPLESPERPIXEL tag in a greyscale TIFF image with multiple samples per pixel.
Family:	unix	Class:	patch
Reference(s):	RHSA-2011:1328-01 CVE-2011-3193 CVE-2011-3194	Version:	29
Platform(s):	Red Hat Enterprise Linux 6	Product(s):	qt
Definition Synopsis:
The operating system installed on the system is Red Hat Enterprise Linux 6 Packages section qt-odbc is earlier than 1:4.6.2-20.el6 AND qt-demos is earlier than 1:4.6.2-20.el6 AND qt-mysql is earlier than 1:4.6.2-20.el6 AND qt-x11 is earlier than 1:4.6.2-20.el6 AND qt-doc is earlier than 1:4.6.2-20.el6 AND phonon-backend-gstreamer is earlier than 1:4.6.2-20.el6 AND qt-postgresql is earlier than 1:4.6.2-20.el6 AND qt-sqlite is earlier than 1:4.6.2-20.el6 AND qt is earlier than 1:4.6.2-20.el6 AND qt-examples is earlier than 1:4.6.2-20.el6 AND qt-devel is earlier than 1:4.6.2-20.el6

Definition Id: oval:org.mitre.oval:def:23201

Oval ID:	oval:org.mitre.oval:def:23201
Title:	ELSA-2011:1323: qt security update (Moderate)
Description:	Buffer overflow in the TIFF reader in gui/image/qtiffhandler.cpp in Qt 4.7.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the TIFFTAG_SAMPLESPERPIXEL tag in a greyscale TIFF image with multiple samples per pixel.
Family:	unix	Class:	patch
Reference(s):	ELSA-2011:1323-01 CVE-2011-3193 CVE-2011-3194	Version:	13
Platform(s):	Oracle Linux 6	Product(s):	qt
Definition Synopsis:
Oracle Linux 6.x rpm test qt-demos is earlier than 1:4.6.2-17.el6_1.1 AND qt-odbc is earlier than 1:4.6.2-17.el6_1.1 AND qt-mysql is earlier than 1:4.6.2-17.el6_1.1 AND qt-doc is earlier than 1:4.6.2-17.el6_1.1 AND qt-x11 is earlier than 1:4.6.2-17.el6_1.1 AND phonon-backend-gstreamer is earlier than 1:4.6.2-17.el6_1.1 AND qt-postgresql is earlier than 1:4.6.2-17.el6_1.1 AND qt-sqlite is earlier than 1:4.6.2-17.el6_1.1 AND qt is earlier than 1:4.6.2-17.el6_1.1 AND qt-examples is earlier than 1:4.6.2-17.el6_1.1 AND qt-devel is earlier than 1:4.6.2-17.el6_1.1

Definition Id: oval:org.mitre.oval:def:23765

Oval ID:	oval:org.mitre.oval:def:23765
Title:	ELSA-2011:1328: qt security update (Moderate)
Description:	Buffer overflow in the TIFF reader in gui/image/qtiffhandler.cpp in Qt 4.7.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the TIFFTAG_SAMPLESPERPIXEL tag in a greyscale TIFF image with multiple samples per pixel.
Family:	unix	Class:	patch
Reference(s):	ELSA-2011:1328-01 CVE-2011-3193 CVE-2011-3194	Version:	13
Platform(s):	Oracle Linux 6	Product(s):	qt
Definition Synopsis:
Oracle Linux 6.x rpm test qt-odbc is earlier than 1:4.6.2-20.el6 AND qt-demos is earlier than 1:4.6.2-20.el6 AND qt-mysql is earlier than 1:4.6.2-20.el6 AND qt-x11 is earlier than 1:4.6.2-20.el6 AND qt-doc is earlier than 1:4.6.2-20.el6 AND phonon-backend-gstreamer is earlier than 1:4.6.2-20.el6 AND qt-postgresql is earlier than 1:4.6.2-20.el6 AND qt-sqlite is earlier than 1:4.6.2-20.el6 AND qt is earlier than 1:4.6.2-20.el6 AND qt-examples is earlier than 1:4.6.2-20.el6 AND qt-devel is earlier than 1:4.6.2-20.el6

Definition Id: oval:org.mitre.oval:def:27524

Oval ID:	oval:org.mitre.oval:def:27524
Title:	DEPRECATED: ELSA-2011-1323 -- qt security update (moderate)
Description:	[1:4.6.2-17.1] - Resolves: #rhbz737812 fix multiple flaws in Qt CVE-2011-3193, CVE-2011-3194
Family:	unix	Class:	patch
Reference(s):	ELSA-2011-1323 CVE-2011-3193 CVE-2011-3194	Version:	4
Platform(s):	Oracle Linux 6	Product(s):	qt
Definition Synopsis:
Oracle Linux 6.x Packages match section qt is earlier than 0:4.6.2-17.el6_1.1 AND phonon-backend-gstreamer is earlier than 0:4.6.2-17.el6_1.1 AND qt-demos is earlier than 0:4.6.2-17.el6_1.1 AND qt-devel is earlier than 0:4.6.2-17.el6_1.1 AND qt-doc is earlier than 0:4.6.2-17.el6_1.1 AND qt-examples is earlier than 0:4.6.2-17.el6_1.1 AND qt-mysql is earlier than 0:4.6.2-17.el6_1.1 AND qt-odbc is earlier than 0:4.6.2-17.el6_1.1 AND qt-postgresql is earlier than 0:4.6.2-17.el6_1.1 AND qt-sqlite is earlier than 0:4.6.2-17.el6_1.1 AND qt-x11 is earlier than 0:4.6.2-17.el6_1.1

Definition Id: oval:org.mitre.oval:def:28169

Oval ID:	oval:org.mitre.oval:def:28169
Title:	DEPRECATED: ELSA-2011-1328 -- qt security update (moderate)
Description:	[4.6.2-20] - Resolves: #rhbz737813 fix multiple flaws in Qt CVE-2011-3193, CVE-2011-3194 [4.6.2-19] - Resolves: rhbz#679759, missing executable bit in qt-examples binaries - Resolves: rhbz#716694, move macros.qt4 to -devel - Resolves: rhbz#680088, rpmdiff failure [4.6.2-18] - Resolves: rhbz#562132, Malayalam rakar is not getting reordered
Family:	unix	Class:	patch
Reference(s):	ELSA-2011-1328 CVE-2011-3193 CVE-2011-3194	Version:	4
Platform(s):	Oracle Linux 6	Product(s):	qt
Definition Synopsis:
Oracle Linux 6.x Packages match section qt is earlier than 0:4.6.2-20.el6 AND phonon-backend-gstreamer is earlier than 0:4.6.2-20.el6 AND qt-demos is earlier than 0:4.6.2-20.el6 AND qt-devel is earlier than 0:4.6.2-20.el6 AND qt-doc is earlier than 0:4.6.2-20.el6 AND qt-examples is earlier than 0:4.6.2-20.el6 AND qt-mysql is earlier than 0:4.6.2-20.el6 AND qt-odbc is earlier than 0:4.6.2-20.el6 AND qt-postgresql is earlier than 0:4.6.2-20.el6 AND qt-sqlite is earlier than 0:4.6.2-20.el6 AND qt-x11 is earlier than 0:4.6.2-20.el6

CPE : Common Platform Enumeration

Type	Description	Count
Application	Qt cpe:2.3:a:qt:qt:4.7.4:::::::*	1

OpenVAS Exploits

Date	Description
2012-08-10	Name : Gentoo Security Advisory GLSA 201206-02 (qt-gui) File : nvt/glsa_201206_02.nasl
2012-07-16	Name : Ubuntu Update for qt4-x11 USN-1504-1 File : nvt/gb_ubuntu_USN_1504_1.nasl
2012-07-09	Name : RedHat Update for qt RHSA-2011:1323-01 File : nvt/gb_RHSA-2011_1323-01_qt.nasl
2011-09-30	Name : Fedora Update for qt FEDORA-2011-12193 File : nvt/gb_fedora_2011_12193_qt_fc15.nasl
2011-09-27	Name : Fedora Update for qt FEDORA-2011-12145 File : nvt/gb_fedora_2011_12145_qt_fc14.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
75653	Qt src/gui/image/qtiffhandler.cpp TIFF Reader Grayscale Image Handling Overflow

Nessus® Vulnerability Scanner

Date	Description
2015-03-26	Name : The remote Debian host is missing a security update. File : debian_DLA-117.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : suse_11_3_libQtWebKit-devel-110908.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : suse_11_4_libQtWebKit-devel-110908.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-1323.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20110921_qt_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-07-12	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1504-1.nasl - Type : ACT_GATHER_INFO
2012-06-21	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201206-02.nasl - Type : ACT_GATHER_INFO
2011-12-13	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_libQtWebKit-devel-110908.nasl - Type : ACT_GATHER_INFO
2011-09-27	Name : The remote Fedora host is missing a security update. File : fedora_2011-12193.nasl - Type : ACT_GATHER_INFO
2011-09-26	Name : The remote Fedora host is missing a security update. File : fedora_2011-12145.nasl - Type : ACT_GATHER_INFO
2011-09-22	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1323.nasl - Type : ACT_GATHER_INFO
2011-09-22	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1328.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:37:20	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	7
CPE ID(s)	1
osvdb(s)	1
Openvas Exploit(s)	5
Nessus® Exploit(s)	12

	Related
9.3	CVE-2011-3194
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)

9.3 - GLSA-201206-02

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU