CVE-2018-19873

nvd nist

Published: Dec 26, 2018Modified: Feb 11, 2025

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.

Affected (13)

Products: Qt: Qt · Opensuse: Backports, Leap · Debian: Debian Linux · +1 more

Show all products

Qt: Qt · Opensuse: Backports, Leap · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

2 products

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Qt Qt	Up to 5.5.1
Qt Qt	From 5.10.0 to 5.11.3
Qt Qt	From 5.7.0 to 5.8.0

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Opensuse Backports	Version sle-15 sp1
Opensuse Backports	Version sle-15 sp2
Opensuse Leap	Version 15.1
Opensuse Leap	Version 15.2
Opensuse Leap	Version 42.3

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 18.10

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (28)

http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00066.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00057.html

Source: cve@mitre.org

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00071.html

Source: cve@mitre.org

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00073.html

Source: cve@mitre.org

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00090.html

Source: cve@mitre.org

Mailing List

https://access.redhat.com/errata/RHSA-2019:2135

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3390

Source: cve@mitre.org

Third Party Advisory

https://blog.qt.io/blog/2018/12/04/qt-5-11-3-released-important-security-updates/

Source: cve@mitre.org

Release NotesVendor Advisory

https://codereview.qt-project.org/#/c/238749/

Source: cve@mitre.org

Issue TrackingPatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2019/01/msg00004.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2019/05/msg00014.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/09/msg00023.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://usn.ubuntu.com/4003-1/

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://www.debian.org/security/2019/dsa-4374

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00066.html