[ GLSA 201206-02 ] QtGui: User-assisted execution of arbitrary code

[GLSA]

Gentoo Linux Security Advisory

Title: QtGui: User-assisted execution of arbitrary code (GLSA 201206-02)
Severity: normal
Exploitable: remote
Date: June 03, 2012
Bug(s): #384089
ID: 201206-02

Synopsis

A buffer overflow in QtGui could result in execution of arbitrary
code or Denial of Service.


Background

QtGui is a module for the Qt toolkit.

Affected Packages

Package: x11-libs/qt-gui
Vulnerable: < 4.7.4-r1
Unaffected: >= 4.7.4-r1
Architectures: All supported architectures


Description

An error in qtiffhandler.cpp could cause a buffer overflow.

Impact

A remote attacker could entice a user to open a specially crafted TIFF
image with an application linked against QtGui, possibly resulting in
execution of arbitrary code with the privileges of the process or a
Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All QtGui users should upgrade to the latest version: