CVE-2007-4137 (NVD)

2007-09-18

Off-by-one error in the QUtf8Decoder::toUnicode function in Trolltech Qt 3 allows context-dependent attackers to cause a denial of service (crash) via a crafted Unicode string that triggers a heap-based buffer overflow. NOTE: Qt 4 has the same error in the QUtf8Codec::convertToUnicode function, but it is not exploitable.

Products Qt
Type Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
First patch - None (likely due to unavailable code)
Links • http://secunia.com/advisories/27053
• http://secunia.com/advisories/27996
• http://osvdb.org/39384
• https://issues.rpath.com/browse/RPL-1751
• http://secunia.com/advisories/28021