Vulnerability Name:

CVE-2004-0692 (CCN-17041)

Assigned:2004-08-18
Published:2004-08-18
Updated:2017-10-11
Summary:The XPM parser in the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (application crash) via a malformed image file that triggers a null dereference, a different vulnerability than CVE-2004-0693.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2004-0692

Source: CCN
Type: Conectiva Linux Security Announcement CLSA-2004:866
Fixes for image loader vulnerabilities

Source: FEDORA
Type: UNKNOWN
FLSA:2314

Source: CCN
Type: RHSA-2004-414
qt security update

Source: CCN
Type: RHSA-2004-478
XFree86 security update

Source: CCN
Type: RHSA-2004-479
XFree86 security update

Source: GENTOO
Type: Patch, Vendor Advisory
GLSA-200408-20

Source: CCN
Type: Slackware Security Advisories Mon, 23 Aug 2004 15:10:53 -0700 (PDT)
[slackware-security] Qt (SSA:2004-236-01)

Source: CCN
Type: Sun Alert ID: 57637
Security Vulnerabilities in QT Library May Allow a Remote Unprivileged User to Execute Arbitrary Code

Source: SUNALERT
Type: UNKNOWN
201610

Source: CCN
Type: CIAC Information Bulletin 0-201
Qt Package Vulnerabilities

Source: CCN
Type: CIAC Information Bulletin P-001
Red Hat Updated XFree86 Packages fix Security Issues

Source: DEBIAN
Type: UNKNOWN
DSA-542

Source: DEBIAN
Type: DSA-542
qt -- unsanitised input

Source: CCN
Type: GLSA-200408-20
Qt: Image loader overflows

Source: MANDRAKE
Type: UNKNOWN
MDKSA-2004:085

Source: SUSE
Type: UNKNOWN
SUSE-SA:2004:027

Source: REDHAT
Type: UNKNOWN
RHSA-2004:414

Source: CCN
Type: BID-10977
Multiple Qt Image Handling Heap Overflow Vulnerabilities

Source: CCN
Type: TLSA-2004-21
Multiple vulnerabilities in Qt

Source: XF
Type: UNKNOWN
qt-xpm-dos(17041)

Source: XF
Type: UNKNOWN
qt-xpm-dos(17041)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10327

Source: SUSE
Type: SUSE-SA:2004:027
qt3: remote system compromise

Vulnerable Configuration:Configuration 1:
  • cpe:/a:trolltech:qt:*:*:*:*:*:*:*:* (Version <= 3.3.3)

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:aw:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • AND
  • cpe:/a:suse:suse_linux_firewall:*:*:*:*:*:*:*:*
  • OR cpe:/a:suse:suse_linux_database_server:*:*:*:*:*:*:*:*
  • OR cpe:/a:suse:suse_email_server:iii:*:*:*:*:*:*:*
  • OR cpe:/a:suse:suse_linux_connectivity_server:*:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/a:suse:suse_linux_office_server:*:*:*:*:*:*:*:*
  • OR cpe:/a:suse:suse_email_server:3.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:8.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:linux_enterprise_server:8:*:*:*:*:*:*:*
  • OR cpe:/o:slackware:slackware_linux:current:*:*:*:*:*:*:*
  • OR cpe:/o:slackware:slackware_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:8.2:*:*:*:*:*:*:*
  • OR cpe:/o:conectiva:linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:slackware:slackware_linux:9.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.1:*:*:*:*:*:*:*
  • OR cpe:/o:conectiva:linux:10:*:*:*:*:*:*:*
  • OR cpe:/o:slackware:slackware_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.2::amd64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.0::amd64:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20040692
    V
    		CVE-2004-0692
    2015-11-16
    oval:org.mitre.oval:def:10327
    V
    		The XPM parser in the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (application crash) via a malformed image file that triggers a null dereference, a different vulnerability than CVE-2004-0693.
    2013-04-29
    oval:com.redhat.rhsa:def:20040478
    P
    		RHSA-2004:478: XFree86 security update (Moderate)
    2004-10-04
    oval:org.debian:def:542
    V
    		unsanitised input
    2004-08-30
    oval:com.redhat.rhsa:def:20040414
    P
    		RHSA-2004:414: qt security update (Important)
    2004-08-20
    BACK
    trolltech qt *
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    suse suse linux firewall *
    suse suse linux database server *
    suse suse email server iii
    suse suse linux connectivity server *
    debian debian linux 3.0
    gentoo linux *
    suse suse linux office server *
    suse suse email server 3.1
    suse suse linux 8.1
    suse linux enterprise server 8
    slackware slackware linux current
    slackware slackware linux 9.0
    suse suse linux 8.2
    conectiva linux 9.0
    slackware slackware linux 9.1
    suse suse linux 9.0
    mandrakesoft mandrake linux 9.2
    mandrakesoft mandrake linux 10.0
    suse suse linux 9.1
    conectiva linux 10
    slackware slackware linux 10.0
    redhat linux advanced workstation 2.1
    mandrakesoft mandrake linux 9.2
    mandrakesoft mandrake linux 10.0