The UTF-8 decoder in codecs/qutfcodec.cpp in Qt 3.3.8 and 4.2.3 does not reject long UTF-8 sequences as required by the standard, which allows remote attackers to conduct cross-site scripting (XSS) and directory traversal attacks via long sequences that decode to dangerous metacharacters.
CVSS Details
- CVSS 3.1 Base Score: 3.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade qt4Upgrade qt4-sqliteUpgrade qt4-postgresqlUpgrade qt4-docUpgrade qt4-odbcUpgrade qt4-mysqlUpgrade qt4-devel | Dec 1, 2016 | Apr 3, 2007 |
| Oracle_linux | — | Upgrade qt-postgresqlUpgrade kdelibsUpgrade qt-configUpgrade qt-mysqlUpgrade qt-develUpgrade qt-odbcUpgrade kdelibs-apidocsUpgrade qt-devel-docsUpgrade kdelibs-develUpgrade qtUpgrade qt-designer | Oct 16, 2024 | Apr 3, 2007 |
| Suse | — | Upgrade qt3-develUpgrade qt3-devel-docUpgrade qt3-devel-tools-32bitUpgrade qt3-x86Upgrade qt3-devel-toolsUpgrade qt3-devel-32bitUpgrade qt3Upgrade qt3-32bit | Feb 17, 2015 | Jun 27, 2013 |
| Ubuntu | — | Upgrade kdelibs4c2aUpgrade libqt3-mtUpgrade kdelibs4c2 | Nov 8, 2024 | Apr 3, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub