In association with heise online

17 September 2007, 10:37

Trolltech fixes vulnerability in Qt libraries

  • Twitter
  • Facebook
  • submit to slashdot
  • StumbleUpon
  • submit to reddit

Trolltech, producer of the cross-platform C++ framework Qt, has released a source code patch for the Qt3 and Qt4 libraries, which fixes a vulnerability in the QUtf8Decoder. The "off-by-one" error when processing Unicode strings can be exploited in Qt3 to crash affected applications or possibly to inject malicious code through a single byte heap overflow.

Although the bug is present in all versions of Qt3 and Qt4, in Qt4 it cannot be used to develop an exploit. A patch for this bug should be included in the forthcoming bug fix release for Qt4. Red Hat has been distributing an updated patch since Friday.


Print Version | Send by email | Permalink:

  • July's Community Calendar

The H Open

The H Security

The H Developer

The H Internet Toolkit