Multiple format string vulnerabilities in (1) qtextedit.cpp, (2) qdatatable.cpp, (3) qsqldatabase.cpp, (4) qsqlindex.cpp, (5) qsqlrecord.cpp, (6) qglobal.cpp, and (7) qsvgdevice.cpp in QTextEdit in Trolltech Qt 3 before 3.3.8 20070727 allow remote attackers to execute arbitrary code via format string specifiers in text used to compose an error message.

From Red Hat Security Advisory 2007:0721 :

Updated qt packages that correct an integer overflow flaw are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Qt is a software toolkit that simplifies the task of writing and maintaining GUI (Graphical User Interface) applications for the X Window System.

Several format string flaws were found in Qt error message handling.
If an application linked against Qt created an error message from user-supplied data in a certain way, it could lead to a denial of service or possibly allow the execution of arbitrary code.
(CVE-2007-3388)

Users of Qt should upgrade to these updated packages, which contain a backported patch to correct these issues.

Red Hat would like to acknowledge Tim Brown of Portcullis Computer Security and Dirk Mueller for these issues.

Several format string flaws were found in Qt error message handling.
If an application linked against Qt created an error message from user-supplied data in a certain way, it could lead to a denial of service or possibly allow the execution of arbitrary code.
(CVE-2007-3388)

Updated qt packages that correct an integer overflow flaw are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Qt is a software toolkit that simplifies the task of writing and maintaining GUI (Graphical User Interface) applications for the X Window System.

Several format string flaws were found in Qt error message handling.
If an application linked against Qt created an error message from user-supplied data in a certain way, it could lead to a denial of service or possibly allow the execution of arbitrary code.
(CVE-2007-3388)

Users of Qt should upgrade to these updated packages, which contain a backported patch to correct these issues.

Red Hat would like to acknowledge Tim Brown of Portcullis Computer Security and Dirk Mueller for these issues.

Format string bugs in QTextEdit can be exploited via specially crafted HTML tags to potentially execute code. (CVE-2007-3388)

Several local/remote vulnerabilities have been discovered in the Qt GUI library. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-3388     Tim Brown and Dirk Muller discovered several format     string vulnerabilities in the handling of error     messages, which might lead to the execution of arbitrary     code.

  - CVE-2007-4137     Dirk Muller discovered an off-by-one buffer overflow in     the Unicode handling, which might lead to the execution     of arbitrary code.

Several format string vulnerabilities have been discovered in Qt warning messages. By causing an application to process specially crafted input data which triggered Qt warnings, this could be exploited to execute arbitrary code with the privilege of the user running the application.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Sep 17 2007 Than Ngo <than at redhat.com> -     1:3.3.8-7

    - bz292941, CVE-2007-4137

    - Wed Aug 29 2007 Than Ngo <than at redhat.com> -       1:3.3.8-6.fc7.1

    - cleanup security patch

    - Tue Aug 28 2007 Than Ngo <than at redhat.com> -       1:3.3.8-6.fc7

    - CVE-2007-3388 qt3 format string flaw

    - Thu Jun 14 2007 Than Ngo <than at redhat.com> -       1:3.3.8-5.fc7.1

    - backport to fix #bz243722, bz#244148, Applications       using qt-mysql crash if database is removed before       QApplication is destroyed

  - Mon Apr 23 2007 Than Ngo <than at redhat.com> -     1:3.3.8-5.fc7

    - apply patch to fix fontrendering problem in gu_IN       #228451,#228452

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Format string bugs in QTextEdit can be exploited via specially crafted HTML tags to potentially execute code (CVE-2007-3388).

- Mon Sep 17 2007 Than Ngo <than at redhat.com> -     1:3.3.8-2.fc6

    - bz292951, CVE-2007-4137

    - Wed Aug 29 2007 Than Ngo <than at redhat.com> -       1:3.3.8-1.fc6.1

    - CVE-2007-3388 qt format string flaw

    - bz#234635, CVE-2007-0242 qt UTF8 improper character       expansion

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200708-16 (Qt: Multiple format string vulnerabilities)

    Tim Brown of Portcullis Computer Security Ltd and Dirk Mueller of KDE     reported multiple format string errors in qWarning() calls in files     qtextedit.cpp, qdatatable.cpp, qsqldatabase.cpp, qsqlindex.cpp,     qsqlrecord.cpp, qglobal.cpp, and qsvgdevice.cpp.
  Impact :

    An attacker could trigger one of the vulnerabilities by causing a Qt     application to parse specially crafted text, which may lead to the     execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

New qt packages are available for Slackware 10.2, 11.0, and 12.0 to fix format string errors.

A number of format string flaws have been discovered in how Qt handled error messages by Dirk Mueller and Tim Brown of Portcullis Computer Security. If an application linked against Qt created an error message from user-supplied data in a certain way, it could possibly lead to the execution of arbitrary code or a denial of service.

This update provides packages which are patched to prevent these issues.

ID	Name	Product	Family	Severity
67545	Oracle Linux 3 / 4 / 5 : qt (ELSA-2007-0721)	Nessus	Oracle Linux Local Security Checks	medium
60237	Scientific Linux Security Update : qt on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
38130	CentOS 3 / 4 / 5 : qt (CESA-2007:0721)	Nessus	CentOS Local Security Checks	medium
29565	SuSE 10 Security Update : Qt3 (ZYPP Patch Number 3898)	Nessus	SuSE Local Security Checks	medium
29261	Debian DSA-1426-1 : qt-x11-free - several vulnerabilities	Nessus	Debian Local Security Checks	high
28097	Ubuntu 6.06 LTS / 6.10 / 7.04 : qt-x11-free vulnerability (USN-495-1)	Nessus	Ubuntu Local Security Checks	medium
27760	Fedora 7 : qt-3.3.8-7.fc7 (2007-2216)	Nessus	Fedora Local Security Checks	high
27414	openSUSE 10 Security Update : qt3 (qt3-3899)	Nessus	SuSE Local Security Checks	medium
26083	Fedora Core 6 : qt-3.3.8-2.fc6 (2007-703)	Nessus	Fedora Local Security Checks	high
25944	GLSA-200708-16 : Qt: Multiple format string vulnerabilities	Nessus	Gentoo Local Security Checks	medium
25846	Slackware 10.2 / 11.0 / 12.0 : qt (SSA:2007-222-03)	Nessus	Slackware Local Security Checks	medium
25835	Mandrake Linux Security Advisory : qt3 (MDKSA-2007:151)	Nessus	Mandriva Local Security Checks	medium
25828	RHEL 3 / 4 / 5 : qt (RHSA-2007:0721)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2007-3388

high

Tenable Plugins

medium

medium

medium

medium

high

medium

high

medium

high

medium

medium

medium

medium