Vulnerability in Digia Qt

CVE-2015-0295

The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color components, which allows remote attackers to cause a denial of service (divide-by-zero and crash) via a crafted BMP file.

EPSS: 0.063 (92.9th percentile) — read the EPSS interpretation.

Affected products

Digia Qt
Fedoraproject Fedora — versions 20, 21, 22
Opensuse — versions 13.1
N/a — versions n/a

Weakness classification (CWE)

CWE-189

References

secalert@redhat.com (vdb-entry, x_refsource_BID)
secalert@redhat.com (Vendor Advisory, mailing-list, x_refsource_MLIST)
secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory)
secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)