Description
The XPM parser in the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (application crash) via a malformed image file that triggers a null dereference, a different vulnerability than CVE-2004-0693.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | qt-copy | 3.0.3-20020329-1woody2 | DSA-542-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | XFree86 +29 | 4.3.0-69.EL | RHSA-2004:478 |
| RHEL 3 | qt +5 | 1:3.1.2-13.4 | RHSA-2004:414 |
Advisories 3
- RHSA-2004:478 Red Hat Security Advisory: XFree86 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2004:414 Red Hat Security Advisory: qt security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-542-1 qt - unsanitised input Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200408-20 vendor-advisory
- SUSE-SA:2004:027 vendor-advisory
- RHSA-2004:414 vendor-advisory
- qt-xpm-dos(17041) vdb-entry
- DSA-542 vendor-advisory
- FLSA:2314 vendor-advisory
- 201610 vendor-advisory
- oval:org.mitre.oval:def:10327 vdb-entry signature
- MDKSA-2004:085 vendor-advisory