Mandrake Linux Security Advisory : qt3 (MDKSA-2004:085)

High Nessus Plugin ID 14334


The remote Mandrake Linux host is missing one or more security updates.


Chris Evans discovered a heap-based overflow in the QT library when handling 8-bit RLE encoded BMP files. This vulnerability could allow for the compromise of the account used to view or browse malicious BMP files. On subsequent investigation, it was also found that the handlers for XPM, GIF, and JPEG image types were also faulty.

These problems affect all applications that use QT to handle image files, such as QT-based image viewers, the Konqueror web browser, and others.

The updated packages have been patched to correct these problems.


Update the affected packages.

Plugin Details

Severity: High

ID: 14334

File Name: mandrake_MDKSA-2004-085.nasl

Version: $Revision: 1.16 $

Type: local

Published: 2004/08/22

Modified: 2013/05/31

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:lib64qt3, p-cpe:/a:mandriva:linux:lib64qt3-devel, p-cpe:/a:mandriva:linux:lib64qt3-mysql, p-cpe:/a:mandriva:linux:lib64qt3-odbc, p-cpe:/a:mandriva:linux:lib64qt3-psql, p-cpe:/a:mandriva:linux:libqt3, p-cpe:/a:mandriva:linux:libqt3-devel, p-cpe:/a:mandriva:linux:libqt3-mysql, p-cpe:/a:mandriva:linux:libqt3-odbc, p-cpe:/a:mandriva:linux:libqt3-psql, p-cpe:/a:mandriva:linux:qt3-common, p-cpe:/a:mandriva:linux:qt3-example, cpe:/o:mandrakesoft:mandrake_linux:10.0, cpe:/o:mandrakesoft:mandrake_linux:9.2

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 2004/08/18

Reference Information

CVE: CVE-2004-0691, CVE-2004-0692, CVE-2004-0693

MDKSA: 2004:085