GLSA-200708-16 : Qt: Multiple format string vulnerabilities

Medium Nessus Plugin ID 25944


The remote Gentoo host is missing one or more security-related patches.


The remote host is affected by the vulnerability described in GLSA-200708-16 (Qt: Multiple format string vulnerabilities)

Tim Brown of Portcullis Computer Security Ltd and Dirk Mueller of KDE reported multiple format string errors in qWarning() calls in files qtextedit.cpp, qdatatable.cpp, qsqldatabase.cpp, qsqlindex.cpp, qsqlrecord.cpp, qglobal.cpp, and qsvgdevice.cpp.
Impact :

An attacker could trigger one of the vulnerabilities by causing a Qt application to parse specially crafted text, which may lead to the execution of arbitrary code.
Workaround :

There is no known workaround at this time.


All Qt 3 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '=x11-libs/qt-3*'

See Also

Plugin Details

Severity: Medium

ID: 25944

File Name: gentoo_GLSA-200708-16.nasl

Version: $Revision: 1.12 $

Type: local

Published: 2007/08/28

Modified: 2015/04/13

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:qt, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2007/08/22

Reference Information

CVE: CVE-2007-3388

BID: 25154

OSVDB: 39385

GLSA: 200708-16