The UTF-8 decoder in codecs/qutfcodec.cpp in Qt 3.3.8 and 4.2.3 does not reject long UTF-8 sequences as required by the standard, which allows remote attackers to conduct cross-site scripting (XSS) and directory traversal attacks via long sequences that decode to dangerous metacharacters.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1324 advisory.

    - Resolves: #737815, qt/harfbuzz buffer overflow, CVE-2011-3193

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0909 advisory.

    [3.5.4-13.el5.0.1]
     - Remove Version branding
     - Maximum rpm trademark logos removed (pics/crystalsvg/*-mime-rpm*)

     [3.5.4-13.el5]
     - Resolves: #293571        CVE-2007-0537 Konqueror improper HTML comment rendering        CVE-2007-1564 FTP protocol PASV design flaw affects konqueror

     [3.5.4-12.el5]
     - resolves: #293421, CVE-2007-3820 CVE-2007-4224 CVE-2007-4225
     - Resolves: #293911, UTF-8 overlong sequence decoding vulnerability,      CVE-2007-0242
     - Resolves: #293571, Konqueror improper HTML comment rendering,      CVE-2007-0537

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0883 advisory.

    [3.3.6-23]
     - Resolves: #277011, Qt UTF8 improper character expansion, CVE-2007-0242
     - Resolves: #269141, Qt off by one buffer overflow, CVE-2007-413

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Qt 4 is a software toolkit that simplifies the task of writing and maintaining GUI (Graphical User Interface) applications for the X Window System. HarfBuzz is an OpenType text shaping engine.

A flaw in the way Qt 4 expanded certain UTF-8 characters could be used to prevent a Qt 4 based application from properly sanitizing user input. Depending on the application, this could allow an attacker to perform directory traversal, or for web applications, a cross-site scripting (XSS) attack. (CVE-2007-0242)

A buffer overflow flaw was found in the harfbuzz module in Qt 4. If a user loaded a specially crafted font file with an application linked against Qt 4, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-3193)

Users of Qt 4 should upgrade to these updated packages, which contain backported patches to correct these issues. All running applications linked against Qt 4 libraries must be restarted for this update to take effect.

Two cross-site-scripting flaws were found in the way Konqueror processes certain HTML content. This could result in a malicious attacker presenting misleading content to an unsuspecting user.
(CVE-2007-0242, CVE-2007-0537)

A flaw was found in KDE JavaScript implementation. A web page containing malicious JavaScript code could cause Konqueror to crash.
(CVE-2007-1308)

A flaw was found in the way Konqueror handled certain FTP PASV commands. A malicious FTP server could use this flaw to perform a rudimentary port-scan of machines behind a user's firewall.
(CVE-2007-1564)

Two Konqueror address spoofing flaws have been discovered. It was possible for a malicious website to cause the Konqueror address bar to display information which could trick a user into believing they are at a different website than they actually are. (CVE-2007-3820, CVE-2007-4224)

A flaw was found in the way Qt expanded certain UTF8 characters. It was possible to prevent a Qt-based application from properly sanitizing user supplied input. This could, for example, result in a cross-site scripting attack against the Konqueror web browser.
(CVE-2007-0242)

A buffer overflow flaw was found in the way Qt expanded malformed Unicode strings. If an application linked against Qt parsed a malicious Unicode string, it could lead to a denial of service or possibly allow the execution of arbitrary code. (CVE-2007-4137)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1324 advisory.

    Qt 4 is a software toolkit that simplifies the task of writing and     maintaining GUI (Graphical User Interface) applications for the X Window     System. HarfBuzz is an OpenType text shaping engine.

    A flaw in the way Qt 4 expanded certain UTF-8 characters could be used to     prevent a Qt 4 based application from properly sanitizing user input.
    Depending on the application, this could allow an attacker to perform     directory traversal, or for web applications, a cross-site scripting (XSS)     attack. (CVE-2007-0242)

    A buffer overflow flaw was found in the harfbuzz module in Qt 4. If a user     loaded a specially-crafted font file with an application linked against Qt     4, it could cause the application to crash or, possibly, execute arbitrary     code with the privileges of the user running the application.
    (CVE-2011-3193)

    Users of Qt 4 should upgrade to these updated packages, which contain     backported patches to correct these issues. All running applications linked     against Qt 4 libraries must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated qt4 packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Qt 4 is a software toolkit that simplifies the task of writing and maintaining GUI (Graphical User Interface) applications for the X Window System. HarfBuzz is an OpenType text shaping engine.

A flaw in the way Qt 4 expanded certain UTF-8 characters could be used to prevent a Qt 4 based application from properly sanitizing user input. Depending on the application, this could allow an attacker to perform directory traversal, or for web applications, a cross-site scripting (XSS) attack. (CVE-2007-0242)

A buffer overflow flaw was found in the harfbuzz module in Qt 4. If a user loaded a specially crafted font file with an application linked against Qt 4, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2011-3193)

Users of Qt 4 should upgrade to these updated packages, which contain backported patches to correct these issues. All running applications linked against Qt 4 libraries must be restarted for this update to take effect.

Andreas Nolden discover a bug in qt3, where the UTF8 decoder does not reject overlong sequences, which can cause '/../' injection or (in the case of konqueror) a '<script>' tag injection.

Updated packages have been patched to address this issue.

Andreas Nolden discover a bug in qt4, where the UTF8 decoder does not reject overlong sequences, which can cause '/../' injection or (in the case of konqueror) a '<script>' tag injection.

Updated packages have been patched to address this issue.

Update :

Packages for Mandriva Linux 2007.1 are now available.

qt wrongly accepts overly long UTF-8 sequences due to a bug in the UTF-8 decoder. This may lead to security problems unter certain circumstances. The bug for example allows for script tag injection in konqueror. (CVE-2007-0242)

qt wongly accepts overly long UTF-8 sequences due to a bug in the UTF-8 decoder. This may lead to security problems unter certain circumstances. The bug for example allows for script tag injection in konqueror. (CVE-2007-0242)

The Qt library did not correctly handle truncated UTF8 strings, which could cause some applications to incorrectly filter malicious strings.
If a Konqueror user were tricked into visiting a website containing specially crafted strings, normal XSS prevention could be bypassed allowing a remote attacker to steal confidential data.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

qt wrongly accepts overly long UTF-8 sequences due to a bug in the UTF-8 decoder. This may lead to security problems unter certain circumstances. The bug for example allows for script tag injection in konqueror (CVE-2007-0242).

Updated kdelibs packages that resolve several security flaws are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdelibs package provides libraries for the K Desktop Environment (KDE).

Two cross-site-scripting flaws were found in the way Konqueror processes certain HTML content. This could result in a malicious attacker presenting misleading content to an unsuspecting user.
(CVE-2007-0242, CVE-2007-0537)

A flaw was found in KDE JavaScript implementation. A web page containing malicious JavaScript code could cause Konqueror to crash.
(CVE-2007-1308)

A flaw was found in the way Konqueror handled certain FTP PASV commands. A malicious FTP server could use this flaw to perform a rudimentary port-scan of machines behind a user's firewall.
(CVE-2007-1564)

Two Konqueror address spoofing flaws have been discovered. It was possible for a malicious website to cause the Konqueror address bar to display information which could trick a user into believing they are at a different website than they actually are. (CVE-2007-3820, CVE-2007-4224)

Users of KDE should upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2007:0909 advisory.

    The kdelibs package provides libraries for the K Desktop Environment (KDE).

    Two cross-site-scripting flaws were found in the way Konqueror processes     certain HTML content. This could result in a malicious attacker presenting     misleading content to an unsuspecting user. (CVE-2007-0242, CVE-2007-0537)

    A flaw was found in KDE JavaScript implementation.  A web page containing     malicious JavaScript code could cause Konqueror to crash. (CVE-2007-1308)

    A flaw was found in the way Konqueror handled certain FTP PASV commands.
    A malicious FTP server could use this flaw to perform a rudimentary     port-scan of machines behind a user's firewall. (CVE-2007-1564)

    Two Konqueror address spoofing flaws have been discovered. It was     possible for a malicious website to cause the Konqueror address bar to     display information which could trick a user into believing they are at a     different website than they actually are. (CVE-2007-3820, CVE-2007-4224)

    Users of KDE should upgrade to these updated packages, which contain     backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Mon Sep 17 2007 Than Ngo <than at redhat.com> -     1:3.3.8-2.fc6

    - bz292951, CVE-2007-4137

    - Wed Aug 29 2007 Than Ngo <than at redhat.com> -       1:3.3.8-1.fc6.1

    - CVE-2007-3388 qt format string flaw

    - bz#234635, CVE-2007-0242 qt UTF8 improper character       expansion

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated qt packages that correct two security flaws are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Qt is a software toolkit that simplifies the task of writing and maintaining GUI (Graphical User Interface) applications for the X Window System.

A flaw was found in the way Qt expanded certain UTF8 characters. It was possible to prevent a Qt-based application from properly sanitizing user-supplied input. This could, for example, result in a cross-site scripting attack against the Konqueror web browser.
(CVE-2007-0242)

A buffer overflow flaw was found in the way Qt expanded malformed Unicode strings. If an application linked against Qt parsed a malicious Unicode string, it could lead to a denial of service or possibly allow the execution of arbitrary code. (CVE-2007-4137)

Users of Qt should upgrade to these updated packages, which contain a backported patch to correct these issues.

Andreas Nolden discovered a bug in the UTF8 decoding routines in qt4-x11, a C++ GUI library framework, that could allow remote attackers to conduct cross-site scripting (XSS) and directory traversal attacks via long sequences that decode to dangerous metacharacters.

A bug was discovered in KJS where UTF8 decoding did not reject overlong sequences. This vulnerability is similar to that discovered by Andreas Nolden in QT3 and QT4, but at this current time there is no known exploit for this issue.

Updated packages have been patched to address this issue.

New qt packages are available for Slackware 10.2, 11.0, and -current to fix a security issue.

ID	Name	Product	Family	Severity
68354	Oracle Linux 5 : qt4 (ELSA-2011-1324)	Nessus	Oracle Linux Local Security Checks	medium
67574	Oracle Linux 5 : Moderate: / kdelibs (ELSA-2007-0909)	Nessus	Oracle Linux Local Security Checks	medium
67568	Oracle Linux 5 : Important: / qt (ELSA-2007-0883)	Nessus	Oracle Linux Local Security Checks	medium
61140	Scientific Linux Security Update : qt4 on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60263	Scientific Linux Security Update : kdelibs on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60250	Scientific Linux Security Update : qt on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
56251	RHEL 5 : qt4 (RHSA-2011:1324)	Nessus	Red Hat Local Security Checks	medium
56248	CentOS 5 : qt4 (CESA-2011:1324)	Nessus	CentOS Local Security Checks	high
37804	Mandrake Linux Security Advisory : qt3 (MDKSA-2007:074)	Nessus	Mandriva Local Security Checks	medium
37324	Mandrake Linux Security Advisory : qt4 (MDKSA-2007:075-1)	Nessus	Mandriva Local Security Checks	medium
29564	SuSE 10 Security Update : Qt3 (ZYPP Patch Number 3052)	Nessus	SuSE Local Security Checks	medium
29562	SuSE 10 Security Update : Qt (ZYPP Patch Number 3047)	Nessus	SuSE Local Security Checks	medium
28049	Ubuntu 5.10 / 6.06 LTS / 6.10 : kdelibs, qt-x11-free vulnerability (USN-452-1)	Nessus	Ubuntu Local Security Checks	medium
27413	openSUSE 10 Security Update : qt3 (qt3-3048)	Nessus	SuSE Local Security Checks	medium
27411	openSUSE 10 Security Update : qt (qt-3050)	Nessus	SuSE Local Security Checks	medium
27332	openSUSE 10 Security Update : libqt4 (libqt4-3056)	Nessus	SuSE Local Security Checks	medium
26974	CentOS 4 / 5 : kdelibs (CESA-2007:0909)	Nessus	CentOS Local Security Checks	medium
26952	RHEL 4 / 5 : kdelibs (RHSA-2007:0909)	Nessus	Red Hat Local Security Checks	medium
26083	Fedora Core 6 : qt-3.3.8-2.fc6 (2007-703)	Nessus	Fedora Local Security Checks	high
26051	RHEL 2.1 / 3 / 4 / 5 : qt (RHSA-2007:0883)	Nessus	Red Hat Local Security Checks	high
26028	CentOS 3 / 4 / 5 : qt (CESA-2007:0883)	Nessus	CentOS Local Security Checks	high
25229	Debian DSA-1292-1 : qt4-x11 - missing input validation	Nessus	Debian Local Security Checks	medium
24942	Mandrake Linux Security Advisory : kdelibs (MDKSA-2007:076)	Nessus	Mandriva Local Security Checks	medium
24918	Slackware 10.2 / 11.0 / current : qt (SSA:2007-093-03)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2007-0242

medium

Tenable Plugins

medium

medium

medium

high

medium

high

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

high

medium

medium

medium