#VU18316 Division by zero in Qt


Published: 2019-04-18

Vulnerability identifier: #VU18316

Vulnerability risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-19872

CWE-ID: CWE-369

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Qt
Universal components / Libraries / Scripting languages

Vendor: Trolltech

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to division by zero error when processing PPM images. A remote attacker can trick the victim to open a specially crafted image and crash the affected application.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Qt: 5.11 - 5.11.2

External links
http://blog.qt.io/blog/2018/12/04/qt-5-11-3-released-important-security-updates/
http://bugreports.qt.io/browse/QTBUG-69449
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2C5FHCR4A636BLTAXL76WWDJLOAHGNYG/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FO7IBY7YYKNMRD5OI3JNNUI42WEM7NUV/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XS6G3ZDFCHWFQD4CFXWFPHREOHBBDTD7/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Red Hat update for qt5
Red Hat Enterprise Linux 7 update for qt
Ubuntu update for Qt
OpenSUSE Linux update for libqt5-qtbase
Multiple vulnerabilities in Qt