CVE-2015-1860 Multiple buffer overflows in gui/image/qgifhandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault) and possibl...
MediumCVSS 6.8
EPSS 8.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple buffer overflows in gui/image/qgifhandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a crafted GIF image.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/qtbase-opensource-src(Debian:12) | < 5.3.2+dfsg-5 | 5.3.2+dfsg-5 |
| debian/qtbase-opensource-src(Debian:13) | < 5.3.2+dfsg-5 | 5.3.2+dfsg-5 |
| debian/qtbase-opensource-src(Debian:14) | < 5.3.2+dfsg-5 | 5.3.2+dfsg-5 |
| fedoraproject fedora | = 20 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
| digia qt | <= 4.8.6 | No fix listed |
| qt | = 5.0.0 | No fix listed |
| qt | = 5.0.1 | No fix listed |
| qt | = 5.0.2 | No fix listed |
| qt | = 5.1.0 | No fix listed |
| qt | = 5.2.0 | No fix listed |
| qt | = 5.2.1 | No fix listed |
| qt | = 5.3.0 | No fix listed |
| qt | = 5.4.1 | No fix listed |
References
- Debian Security Tracker CVE-2015-1860 vendor-advisory
- FEDORA-2015-6114 third-party-advisory vendor-advisory
- FEDORA-2015-6123 patch third-party-advisory vendor-advisory
- FEDORA-2015-6613 third-party-advisory vendor-advisory
- FEDORA-2015-6315 third-party-advisory vendor-advisory
- FEDORA-2015-6364 third-party-advisory vendor-advisory
- FEDORA-2015-6252 third-party-advisory vendor-advisory
- FEDORA-2015-6661 third-party-advisory vendor-advisory
- FEDORA-2015-6573 third-party-advisory vendor-advisory
- [Announce] 20150413 Qt Project Security Advisory - Multiple Vulnerabilities in Qt Image Format Handling mailing-list patch vendor-advisory
- 74302 third-party-advisory vdb-entry
- USN-2626-1 vendor-advisory
- codereview.qt-project.org patch
- GLSA-201603-10 vendor-advisory
- bugs.debian.org issue-tracking