The UTF-8 decoder in codecs/qutfcodec.cpp in Qt 3.3.8 and 4.2.3 does not reject long UTF-8 sequences as required by the standard, which allows remote attackers to conduct cross-site scripting (XSS) and directory traversal attacks via long sequences that decode to dangerous metacharacters.
CVSS Details
- CVSS 3.1 Base Score: 3.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade qt4Upgrade qt4-postgresqlUpgrade qt4-sqliteUpgrade qt4-mysqlUpgrade qt4-develUpgrade qt4-docUpgrade qt4-odbc | Dec 1, 2016 | Apr 3, 2007 |
| Oracle_linux | — | Upgrade qt-mysqlUpgrade qt-postgresqlUpgrade kdelibs-apidocsUpgrade qt-odbcUpgrade kdelibsUpgrade qt-configUpgrade qt-devel-docsUpgrade kdelibs-develUpgrade qt-designerUpgrade qtUpgrade qt-devel | Oct 16, 2024 | Apr 3, 2007 |
| Suse | — | Upgrade qt3-devel-toolsUpgrade qt3-develUpgrade qt3-devel-32bitUpgrade qt3-x86Upgrade qt3-devel-tools-32bitUpgrade qt3-devel-docUpgrade qt3-32bitUpgrade qt3 | Feb 17, 2015 | Jun 27, 2013 |
| Ubuntu | — | Upgrade kdelibs4c2aUpgrade libqt3-mtUpgrade kdelibs4c2 | Nov 8, 2024 | Apr 3, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub