Executive Summary
Summary | |
---|---|
Title | qt security update |
Informations | |||
---|---|---|---|
Name | RHSA-2007:0721 | First vendor Publication | 2007-07-31 |
Vendor | RedHat | Last vendor Modification | 2007-07-31 |
Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 6.8 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated qt packages that correct an integer overflow flaw are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: Qt is a software toolkit that simplifies the task of writing and maintaining GUI (Graphical User Interface) applications for the X Window System. Several format string flaws were found in Qt error message handling. If an application linked against Qt created an error message from user supplied data in a certain way, it could lead to a denial of service or possibly allow the execution of arbitrary code. (CVE-2007-3388) Users of Qt should upgrade to these updated packages, which contain a backported patch to correct these issues. Red Hat would like to acknowledge Tracey Parry of Portcullis Computer Security and Dirk Mueller for these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 248417 - CVE-2007-3388 qt3 format string flaw |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2007-0721.html |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:21840 | |||
Oval ID: | oval:org.mitre.oval:def:21840 | ||
Title: | ELSA-2007:0721: qt security update (Moderate) | ||
Description: | Multiple format string vulnerabilities in (1) qtextedit.cpp, (2) qdatatable.cpp, (3) qsqldatabase.cpp, (4) qsqlindex.cpp, (5) qsqlrecord.cpp, (6) qglobal.cpp, and (7) qsvgdevice.cpp in QTextEdit in Trolltech Qt 3 before 3.3.8 20070727 allow remote attackers to execute arbitrary code via format string specifiers in text used to compose an error message. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2007:0721-03 CVE-2007-3388 | Version: | 6 |
Platform(s): | Oracle Linux 5 | Product(s): | qt |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:9690 | |||
Oval ID: | oval:org.mitre.oval:def:9690 | ||
Title: | Multiple format string vulnerabilities in (1) qtextedit.cpp, (2) qdatatable.cpp, (3) qsqldatabase.cpp, (4) qsqlindex.cpp, (5) qsqlrecord.cpp, (6) qglobal.cpp, and (7) qsvgdevice.cpp in QTextEdit in Trolltech Qt 3 before 3.3.8 20070727 allow remote attackers to execute arbitrary code via format string specifiers in text used to compose an error message. | ||
Description: | Multiple format string vulnerabilities in (1) qtextedit.cpp, (2) qdatatable.cpp, (3) qsqldatabase.cpp, (4) qsqlindex.cpp, (5) qsqlrecord.cpp, (6) qglobal.cpp, and (7) qsvgdevice.cpp in QTextEdit in Trolltech Qt 3 before 3.3.8 20070727 allow remote attackers to execute arbitrary code via format string specifiers in text used to compose an error message. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2007-3388 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2009-10-10 | Name : SLES9: Security update for Qt3 File : nvt/sles9p5012275.nasl |
2009-04-09 | Name : Mandriva Update for qt3 MDKSA-2007:151 (qt3) File : nvt/gb_mandriva_MDKSA_2007_151.nasl |
2009-03-23 | Name : Ubuntu Update for qt-x11-free vulnerability USN-495-1 File : nvt/gb_ubuntu_USN_495_1.nasl |
2009-02-27 | Name : Fedora Update for qt FEDORA-2007-2216 File : nvt/gb_fedora_2007_2216_qt_fc7.nasl |
2009-02-27 | Name : Fedora Update for qt FEDORA-2007-703 File : nvt/gb_fedora_2007_703_qt_fc6.nasl |
2009-01-28 | Name : SuSE Update for qt3 SUSE-SA:2007:048 File : nvt/gb_suse_2007_048.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200708-16 (qt) File : nvt/glsa_200708_16.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200712-08 (emul-linux-x86-qtlibs) File : nvt/glsa_200712_08.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 1426-1 (qt-x11-free) File : nvt/deb_1426_1.nasl |
0000-00-00 | Name : Slackware Advisory SSA:2007-222-03 qt File : nvt/esoft_slk_ssa_2007_222_03.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
39385 | QT QTextEdit Error Message Handling Remote Format String A format string flaw exists in Qt. The library fails to properly sanitize format string specifiers (e.g., %s and %x). With a specially crafted request, a CONTEXT-DEPENDENT attacker can crash the service or possibly execute arbitrary code. It was possible to trigger the vulnerability from the URL bar of versions of KDE's Konqueror web browser that were linked against the vulnerable library. |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0721.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20070731_qt_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0721.nasl - Type : ACT_GATHER_INFO |
2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_qt3-3898.nasl - Type : ACT_GATHER_INFO |
2007-12-11 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1426.nasl - Type : ACT_GATHER_INFO |
2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-495-1.nasl - Type : ACT_GATHER_INFO |
2007-11-06 | Name : The remote Fedora host is missing a security update. File : fedora_2007-2216.nasl - Type : ACT_GATHER_INFO |
2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_qt3-3899.nasl - Type : ACT_GATHER_INFO |
2007-09-24 | Name : The remote Fedora Core host is missing a security update. File : fedora_2007-703.nasl - Type : ACT_GATHER_INFO |
2007-08-28 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200708-16.nasl - Type : ACT_GATHER_INFO |
2007-08-13 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2007-222-03.nasl - Type : ACT_GATHER_INFO |
2007-08-02 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-151.nasl - Type : ACT_GATHER_INFO |
2007-08-01 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0721.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:50:53 |
|