Description
Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image.
References (10)
Core 10
Core References
Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155424.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/74307
Patch, Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155927.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/74310
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/201603-10
Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155962.html
Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155976.html
Patch, Vendor Advisory mailing-list
x_refsource_mlist
http://lists.qt-project.org/pipermail/announce/2015-April/000067.html
Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156727.html
Vendor Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2626-1
Scores
EPSS
0.0719
EPSS Percentile
93.6%
Details
CWE
CWE-119
Status
published
Products (12)
digia/qt
< 4.8.6
fedoraproject/fedora
20
fedoraproject/fedora
21
fedoraproject/fedora
22
qt/qt
5.0.0
qt/qt
5.0.1
qt/qt
5.0.2
qt/qt
5.1.0
qt/qt
5.2.0
qt/qt
5.2.1
... and 2 more
Published
May 12, 2015
Tracked Since
Feb 18, 2026