Description
Off-by-one error in the QUtf8Decoder::toUnicode function in Trolltech Qt 3 allows context-dependent attackers to cause a denial of service (crash) via a crafted Unicode string that triggers a heap-based buffer overflow. NOTE: Qt 4 has the same error in the QUtf8Codec::convertToUnicode function, but it is not exploitable.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | qt-x11-free | 3:3.3.7-4etch1 | DSA-1426-1 |
| Debian 3.1 | qt-x11-free | 3:3.3.4-3sarge3 | DSA-1426-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | qt +7 | 1:3.3.6-23.el5 | RHSA-2007:0883 |
| RHEL 4 | qt +6 | 1:3.3.3-13.RHEL4 | RHSA-2007:0883 |
| RHEL 3 | qt +5 | 1:3.1.2-17.RHEL3 | RHSA-2007:0883 |
| RHEL 2 | qt +4 | 1:2.3.1-14.EL2 | RHSA-2007:0883 |
Advisories 2
- RHSA-2007:0883 Red Hat Security Advisory: qt security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1426-1 qt-x11-free - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://bugs.gentoo.org/show_bug.cgi?id=192472
- MDKSA-2007:183 vendor-advisory
- SUSE-SR:2007:019 vendor-advisory
- 26868 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-424.htm
- https://issues.rpath.com/browse/RPL-1751
- 26811 third-party-advisory
- oval:org.mitre.oval:def:11159 vdb-entry signature
- 27053 third-party-advisory
- 27996 third-party-advisory
- 27275 third-party-advisory
- 27382 third-party-advisory
- 26857 third-party-advisory
- http://trolltech.com/company/newsroom/announcements/press.2007-09-03.7564032119
- 26778 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=269001
- 26882 third-party-advisory
- 26987 third-party-advisory
- GLSA-200710-28 vendor-advisory
- ADV-2007-3144 vdb-entry
- http://dist.trolltech.com/developer/download/175791_4.diff
- 39384 vdb-entry
- 26804 third-party-advisory
- 26782 third-party-advisory
- http://dist.trolltech.com/developer/download/175791_3.diff
- FEDORA-2007-703 vendor-advisory
- FEDORA-2007-2216 vendor-advisory
- GLSA-200712-08 vendor-advisory
- 28021 third-party-advisory
- RHSA-2007:0883 vendor-advisory
- 1018688 vdb-entry
- 20071004 FLEA-2007-0059-1 qt qt-tools mailing-list
- USN-513-1 vendor-advisory
- 25657 vdb-entry
- DSA-1426 vendor-advisory