Description
The UTF-8 decoder in codecs/qutfcodec.cpp in Qt 3.3.8 and 4.2.3 does not reject long UTF-8 sequences as required by the standard, which allows remote attackers to conduct cross-site scripting (XSS) and directory traversal attacks via long sequences that decode to dangerous metacharacters.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | qt4-x11 | 4.2.1-2etch1 | DSA-1292-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kdelibs +2 | 6:3.5.4-13.el5 | RHSA-2007:0909 |
| RHEL 5 | qt +7 | 1:3.3.6-23.el5 | RHSA-2007:0883 |
| RHEL 5 | qt4 +6 | 4.2.1-1.el5_7.1 | RHSA-2011:1324 |
| RHEL 4 | kdelibs +1 | 6:3.3.1-9.el4 | RHSA-2007:0909 |
| RHEL 4 | qt +6 | 1:3.3.3-13.RHEL4 | RHSA-2007:0883 |
| RHEL 3 | qt +5 | 1:3.1.2-17.RHEL3 | RHSA-2007:0883 |
| RHEL 2 | qt +4 | 1:2.3.1-14.EL2 | RHSA-2007:0883 |
Advisories 4
- RHSA-2011:1324 Red Hat Security Advisory: qt4 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0883 Red Hat Security Advisory: qt security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0909 Red Hat Security Advisory: kdelibs security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1292-1 qt4-x11 Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://support.novell.com/techcenter/psdb/39ea4b325a7da742cb8b6995fa585b14.html
- qt-utf8-xss(33397) vdb-entry
- 24699 third-party-advisory
- RHSA-2007:0909 vendor-advisory
- MDKSA-2007:074 vendor-advisory
- https://issues.rpath.com/browse/RPL-1202
- MDKSA-2007:076 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-424.htm
- 24889 third-party-advisory
- 27275 third-party-advisory
- 24727 third-party-advisory
- 26857 third-party-advisory
- http://www.trolltech.com/company/newsroom/announcements/press.2007-03-30.9172215350
- SUSE-SR:2007:006 vendor-advisory
- http://www.nabble.com/Bug-417390:-CVE-2007-0242%2C--Qt-UTF-8-overlong-sequence-decoding-vulnerability-t3506065.html
- DSA-1292 vendor-advisory
- 24847 third-party-advisory
- 24705 third-party-advisory
- RHSA-2011:1324 vendor-advisory
- 23269 vdb-entry
- 46117 third-party-advisory
- 27108 third-party-advisory
- 24759 third-party-advisory
- USN-452-1 vendor-advisory
- 24726 third-party-advisory
- ADV-2007-1212 vdb-entry
- 25263 third-party-advisory
- 26804 third-party-advisory
- FEDORA-2007-703 vendor-advisory
- oval:org.mitre.oval:def:11510 vdb-entry signature
- RHSA-2007:0883 vendor-advisory
- SSA:2007-093-03 vendor-advisory
- MDKSA-2007:075 vendor-advisory
- http://support.novell.com/techcenter/psdb/fc79b7f48d739f9c803a24ddad933384.html
- 24797 third-party-advisory