Test ID:	1.3.6.1.4.1.25623.1.0.50346
Category:	Fedora Local Security Checks
Title:	Fedora Core 1 FEDORA-2004-270 (qt)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to qt announced via advisory FEDORA-2004-270. During a security audit, Chris Evans discovered a heap overflow in the BMP image decoder in Qt versions prior to 3.3.3. An attacker could create a carefully crafted BMP file in such a way that it would cause an application linked with Qt to crash or possibly execute arbitrary code when the file was opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0691 to this issue. Additionally, various flaws were discovered in the GIF, XPM, and JPEG decoders in Qt versions prior to 3.3.3. An attacker could create carefully crafted image files in such a way that it could cause an application linked against Qt to crash when the file was opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0692 and CVE-2004-0693 to these issues. Users of Qt should update to these updated packages which contain backported patches and are not vulnerable to these issues. This update can be downloaded from: http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/ c763ada78b47f3bc72a06e26b929c8c4 SRPMS/qt-3.1.2-14.2.src.rpm f86739a73579c5b6b698a873b4446d22 x86_64/qt-3.1.2-14.2.x86_64.rpm 6110ba73b9bbce08df7f8529d8185a51 x86_64/qt-devel-3.1.2-14.2.x86_64.rpm 86aad3b91aef11b01da1c816cccaffbe x86_64/qt-ODBC-3.1.2-14.2.x86_64.rpm fb94f45a83cabdfb45751fd293be2ccc x86_64/qt-MySQL-3.1.2-14.2.x86_64.rpm d4077aa9c95b065b89512e8937d3895d x86_64/qt-PostgreSQL-3.1.2-14.2.x86_64.rpm 2dce1a5d23a9f763f34b0f180cf5d5a1 x86_64/qt-designer-3.1.2-14.2.x86_64.rpm b34a6cc0e2af6a58241bdb9e25618919 x86_64/debug/qt-debuginfo-3.1.2-14.2.x86_64.rpm aca527b50ab8b71bbb7e4a6e93278173 i386/qt-3.1.2-14.2.i386.rpm d800a0e0f24c5c748c0e6d4d0cbc766d i386/qt-devel-3.1.2-14.2.i386.rpm 8dc18024573a730fd625a54c4283be63 i386/qt-ODBC-3.1.2-14.2.i386.rpm 62785195ce484b82c388c3bc38992895 i386/qt-MySQL-3.1.2-14.2.i386.rpm 586469add7922ac224dcdc24819ce284 i386/qt-PostgreSQL-3.1.2-14.2.i386.rpm 263b2d0b195ab4869be6f4074df1c728 i386/qt-designer-3.1.2-14.2.i386.rpm fb8ebc4323f3d36032d757a365a9bbbc i386/debug/qt-debuginfo-3.1.2-14.2.i386.rpm This update can also be installed with the Update Agent you can launch the Update Agent with the 'up2date' command. Solution: Apply the appropriate updates. http://www.fedoranews.org/updates/FEDORA-2004-270.shtml Risk factor : High CVSS Score: 7.5
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2004-0691 Bugtraq: 20040818 CESA-2004-004: qt (Google Search) http://marc.info/?l=bugtraq&m=109295309008309&w=2 Debian Security Information: DSA-542 (Google Search) http://www.debian.org/security/2004/dsa-542 http://security.gentoo.org/glsa/glsa-200408-20.xml http://www.mandriva.com/security/advisories?name=MDKSA-2004:085 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9485 http://www.redhat.com/support/errata/RHSA-2004-414.html http://sunsolve.sun.com/search/document.do?assetkey=1-66-201610-1 SuSE Security Announcement: SUSE-SA:2004:027 (Google Search) http://www.novell.com/linux/security/advisories/2004_27_qt3.html XForce ISS Database: qt-bmp-bo(17040) https://exchange.xforce.ibmcloud.com/vulnerabilities/17040 Common Vulnerability Exposure (CVE) ID: CVE-2004-0692 http://marc.info/?l=bugtraq&m=110979666528890&w=2 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10327 XForce ISS Database: qt-xpm-dos(17041) https://exchange.xforce.ibmcloud.com/vulnerabilities/17041 Common Vulnerability Exposure (CVE) ID: CVE-2004-0693 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10883 XForce ISS Database: qt-gif-dos(17042) https://exchange.xforce.ibmcloud.com/vulnerabilities/17042
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.