Integer overflow in Qt 3.3 before 3.3.7, 4.1 before 4.1.5, and 4.2 before 4.2.1, as used in the KDE khtml library, kdelibs 3.1.3, and possibly other packages, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted pixmap image.

From Red Hat Security Advisory 2006:0725 :

Updated qt packages that correct an integer overflow flaw are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Qt is a software toolkit that simplifies the task of writing and maintaining GUI (Graphical User Interface) applications for the X Window System.

An integer overflow flaw was found in the way Qt handled certain pixmap images. If an application linked against Qt created a pixmap image in a certain way, it could lead to a denial of service or possibly allow the execution of arbitrary code. (CVE-2006-4811)

Users of Qt should upgrade to these updated packages, which contain a backported patch to correct this issue.

From Red Hat Security Advisory 2006:0720 :

Updated kdelibs packages that correct an integer overflow flaw are now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The kdelibs package provides libraries for the K Desktop Environment (KDE). Qt is a GUI software toolkit for the X Window System.

An integer overflow flaw was found in the way Qt handled pixmap images. The KDE khtml library uses Qt in such a way that untrusted parameters could be passed to Qt, triggering the overflow. An attacker could for example create a malicious web page that when viewed by a victim in the Konqueror browser would cause Konqueror to crash or possibly execute arbitrary code with the privileges of the victim.
(CVE-2006-4811)

Users of KDE should upgrade to these updated packages, which contain a backported patch to correct this issue.

Updated qt packages that correct an integer overflow flaw are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Qt is a software toolkit that simplifies the task of writing and maintaining GUI (Graphical User Interface) applications for the X Window System.

An integer overflow flaw was found in the way Qt handled certain pixmap images. If an application linked against Qt created a pixmap image in a certain way, it could lead to a denial of service or possibly allow the execution of arbitrary code. (CVE-2006-4811)

Users of Qt should upgrade to these updated packages, which contain a backported patch to correct this issue.

Multiple integer overflows have been found in image processing functions within the QT library. These could potentially lead to heap overflows and code execution. (CVE-2006-4811)

An integer overflow was discovered in Qt's image loader. By processing a specially crafted image with an application that uses this library (like Konqueror), a remote attacker could exploit this to execute arbitrary code with the application's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200703-06 (AMD64 x86 emulation Qt library: Integer overflow)

    An integer overflow flaw has been found in the pixmap handling of Qt,     making the AMD64 x86 emulation Qt library vulnerable as well.
  Impact :

    By enticing a user to open a specially crafted pixmap image in an     application using the AMD64 x86 emulation Qt library, a remote attacker     could cause an application crash or the remote execution of arbitrary     code with the rights of the user running the application.
  Workaround :

    There is no known workaround at this time.

New qt packages are available for Slackware 10.0, 10.1, 10.2, and 11.0 to fix a possible security issue.

An integer overflow was discovered in the way that Qt handled pixmap images. This flaw could be exploited by a remote attacker in a malicious website that, when viewed by an individual using an application that uses Qt (like Konqueror), would cause it to crash or possibly execute arbitrary code with the privileges of the user.

Updated packages have been patched to correct this issue.

A vulnerability was discovered in the way that Qt handled pixmap images and the KDE khtml library used Qt in such a way that untrusted parameters could be passed to Qt, resulting in an integer overflow.
This flaw could be exploited by a remote attacker in a malicious website that, when viewed by an individual using Konqueror, would cause Konqueror to crash or possibly execute arbitrary code with the privileges of the user.

Updated packages have been patched to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200611-02 (Qt: Integer overflow)

    An integer overflow flaw has been found in the pixmap handling of Qt.
  Impact :

    By enticing a user to open a specially crafted pixmap image in an     application using Qt, e.g. Konqueror, a remote attacker could be able     to cause an application crash or the execution of arbitrary code with     the rights of the user running the application.
  Workaround :

    There is no known workaround at this time.

An integer overflow has been found in the pixmap handling routines in the Qt GUI libraries. This could allow an attacker to cause a denial of service and possibly execute arbitrary code by providing a specially crafted image file and inducing the victim to view it in an application based on Qt.

Red Hat reports :

An integer overflow flaw was found in the way Qt handled pixmap images. The KDE khtml library uses Qt in such a way that untrusted parameters could be passed to Qt, triggering the overflow. An attacker could for example create a malicious web page that when viewed by a victim in the Konqueror browser would cause Konqueror to crash or possibly execute arbitrary code with the privileges of the victim.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2006:0720 advisory.

  - security flaw (CVE-2006-4811)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated kdelibs packages that correct an integer overflow flaw are now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The kdelibs package provides libraries for the K Desktop Environment (KDE). Qt is a GUI software toolkit for the X Window System.

An integer overflow flaw was found in the way Qt handled pixmap images. The KDE khtml library uses Qt in such a way that untrusted parameters could be passed to Qt, triggering the overflow. An attacker could for example create a malicious web page that when viewed by a victim in the Konqueror browser would cause Konqueror to crash or possibly execute arbitrary code with the privileges of the victim.
(CVE-2006-4811)

Users of KDE should upgrade to these updated packages, which contain a backported patch to correct this issue.

ID	Name	Product	Family	Severity
67417	Oracle Linux 3 / 4 : qt (ELSA-2006-0725)	Nessus	Oracle Linux Local Security Checks	medium
67416	Oracle Linux 3 / 4 : kdelibs (ELSA-2006-0720)	Nessus	Oracle Linux Local Security Checks	medium
36520	CentOS 3 / 4 : qt (CESA-2006:0725)	Nessus	CentOS Local Security Checks	medium
29563	SuSE 10 Security Update : Qt3 (ZYPP Patch Number 2190)	Nessus	SuSE Local Security Checks	medium
29561	SuSE 10 Security Update : Qt (ZYPP Patch Number 2187)	Nessus	SuSE Local Security Checks	medium
27948	Ubuntu 5.04 / 5.10 / 6.06 LTS : qt-x11-free vulnerability (USN-368-1)	Nessus	Ubuntu Local Security Checks	medium
27412	openSUSE 10 Security Update : qt3 (qt3-2189)	Nessus	SuSE Local Security Checks	medium
27410	openSUSE 10 Security Update : qt (qt-2188)	Nessus	SuSE Local Security Checks	medium
24773	GLSA-200703-06 : AMD64 x86 emulation Qt library: Integer overflow	Nessus	Gentoo Local Security Checks	medium
24657	Slackware 10.0 / 10.1 / 10.2 / 11.0 : qt (SSA:2006-298-01)	Nessus	Slackware Local Security Checks	medium
24572	Mandrake Linux Security Advisory : qt (MDKSA-2006:187)	Nessus	Mandriva Local Security Checks	medium
24571	Mandrake Linux Security Advisory : kdelibs (MDKSA-2006:186)	Nessus	Mandriva Local Security Checks	medium
23626	GLSA-200611-02 : Qt: Integer overflow	Nessus	Gentoo Local Security Checks	medium
22940	RHEL 2.1 / 3 / 4 : qt (RHSA-2006:0725)	Nessus	Red Hat Local Security Checks	medium
22927	Debian DSA-1200-1 : qt-x11-free - integer overflow	Nessus	Debian Local Security Checks	medium
22912	FreeBSD : kdelibs -- integer overflow in khtml (d8fbf13a-6215-11db-a59e-0211d85f11fb)	Nessus	FreeBSD Local Security Checks	medium
22896	RHEL 4 : kdelibs (RHSA-2006:0720)	Nessus	Red Hat Local Security Checks	high
22880	CentOS 3 / 4 : kdelibs (CESA-2006:0720)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2006-4811

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium