CVE-2007-4137

Published: Sep 18, 2007Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Off-by-one error in the QUtf8Decoder::toUnicode function in Trolltech Qt 3 allows context-dependent attackers to cause a denial of service (crash) via a crafted Unicode string that triggers a heap-based buffer overflow. NOTE: Qt 4 has the same error in the QUtf8Codec::convertToUnicode function, but it is not exploitable.

Affected (23)

Products: Trolltech: Qt

Trolltech

1 product

Configuration A

23 vulnerable · 42 platform

Vulnerable Software	Affected Versions
Trolltech Qt	Version 3.0.3
Trolltech Qt	Version 3.0.5
Trolltech Qt	Version 3.0
Trolltech Qt	Version 3.1.1
Trolltech Qt	Version 3.1.2
Trolltech Qt	Version 3.1
Trolltech Qt	Version 3.2.1
Trolltech Qt	Version 3.2.3
Trolltech Qt	Version 3.3.0
Trolltech Qt	Version 3.3.1
Trolltech Qt	Version 3.3.2
Trolltech Qt	Version 3.3.3
Trolltech Qt	Version 3.3.4
Trolltech Qt	Version 3.3.5
Trolltech Qt	Version 3.3.6
Trolltech Qt	Version 3.3.7
Trolltech Qt	Version 3.3.8
Trolltech Qt	Version 4.1.4
Trolltech Qt	Version 4.1.5
Trolltech Qt	Version 4.1
Trolltech Qt	Version 4.2.1
Trolltech Qt	Version 4.2.3
Trolltech Qt	Version 4.2

Running on/with	Platform Versions
Conectiva Linux	Version 10.0
Conectiva Linux	Version 9.0
Gentoo Linux	All versions
Mandrakesoft Mandrake Linux	Version 10.0
Mandrakesoft Mandrake Linux	Version 10.0
Mandrakesoft Mandrake Linux	Version 2007.1
Mandrakesoft Mandrake Linux	Version 2007.1
Mandrakesoft Mandrake Linux	Version 2007
Mandrakesoft Mandrake Linux	Version 2007
Mandrakesoft Mandrake Linux	Version 9.2
Mandrakesoft Mandrake Linux	Version 9.2
Mandrakesoft Mandrake Linux Corporate Server	Version 3.0
Mandrakesoft Mandrake Linux Corporate Server	Version 3.0
Mandrakesoft Mandrake Linux Corporate Server	Version 4.0
Mandrakesoft Mandrake Linux Corporate Server	Version 4.0
Redhat Enterprise Linux	Version 2.1
Redhat Enterprise Linux	Version 2.1
Redhat Enterprise Linux	Version 2.1
Redhat Enterprise Linux	Version 3.0
Redhat Enterprise Linux	Version 3.0
Redhat Enterprise Linux	Version 3.0
Redhat Enterprise Linux	Version 4.0
Redhat Enterprise Linux	Version 4.0
Redhat Enterprise Linux	Version 4.0
Redhat Enterprise Linux	Version 5.0
Redhat Enterprise Linux	Version 5.0
Redhat Enterprise Linux	Version 5.0
Redhat Linux	Version 2.1
Redhat Linux	Version 3.0
Redhat Linux	Version 4.0
Ubuntu Ubuntu Linux	Version 6.06_lts
Ubuntu Ubuntu Linux	Version 6.06_lts
Ubuntu Ubuntu Linux	Version 6.06_lts
Ubuntu Ubuntu Linux	Version 6.06_lts
Ubuntu Ubuntu Linux	Version 6.10
Ubuntu Ubuntu Linux	Version 6.10
Ubuntu Ubuntu Linux	Version 6.10
Ubuntu Ubuntu Linux	Version 6.10
Ubuntu Ubuntu Linux	Version 7.04
Ubuntu Ubuntu Linux	Version 7.04
Ubuntu Ubuntu Linux	Version 7.04
Ubuntu Ubuntu Linux	Version 7.04

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (72)

ftp://patches.sgi.com/support/free/security/advisories/20070901-01-P.asc (unsafe URL)

Source: secalert@redhat.com

http://bugs.gentoo.org/show_bug.cgi?id=192472

Source: secalert@redhat.com

http://dist.trolltech.com/developer/download/175791_3.diff

Source: secalert@redhat.com

http://dist.trolltech.com/developer/download/175791_4.diff

Source: secalert@redhat.com

http://fedoranews.org/updates/FEDORA-2007-221.shtml

Source: secalert@redhat.com

http://fedoranews.org/updates/FEDORA-2007-703.shtml

Source: secalert@redhat.com

http://osvdb.org/39384

Source: secalert@redhat.com

http://secunia.com/advisories/26778

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/26782

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/26804

Source: secalert@redhat.com

http://secunia.com/advisories/26811

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/26857

Source: secalert@redhat.com

http://secunia.com/advisories/26868

Source: secalert@redhat.com

http://secunia.com/advisories/26882

Source: secalert@redhat.com

http://secunia.com/advisories/26987

Source: secalert@redhat.com

http://secunia.com/advisories/27053

Source: secalert@redhat.com

http://secunia.com/advisories/27275

Source: secalert@redhat.com

http://secunia.com/advisories/27382

Source: secalert@redhat.com

http://secunia.com/advisories/27996

Source: secalert@redhat.com

http://secunia.com/advisories/28021

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-200710-28.xml

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-200712-08.xml

Source: secalert@redhat.com

http://securitytracker.com/id?1018688

Source: secalert@redhat.com

http://support.avaya.com/elmodocs2/security/ASA-2007-424.htm

Source: secalert@redhat.com

http://trolltech.com/company/newsroom/announcements/press.2007-09-03.7564032119

Source: secalert@redhat.com

http://www.debian.org/security/2007/dsa-1426

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2007:183

Source: secalert@redhat.com

http://www.novell.com/linux/security/advisories/2007_19_sr.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0883.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/481498/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/25657

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-513-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/3144

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=269001

Source: secalert@redhat.com

https://issues.rpath.com/browse/RPL-1751

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11159

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20070901-01-P.asc (unsafe URL)