Every CVE Search/ Get API key

CVE-2016-10040

Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a...

5.5 MediumFix available

Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a xml file with multiple nested open tags.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.92%Up 0.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.5

Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a xml file with multiple nested open tags.

Record
CVE-2016-10040
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a xml file with multiple nested open tags.

Record
CVE-2016-10040
Updated
2026-11-02
EUVDEUVD-2016-1235 No score

Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a xml file with multiple nested open tags.

Record
EUVD-2016-1235
Updated
2026-11-03
GitHub AdvisoriesGHSA-6ppq-w2qp-6rhq 5.5

Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a...

Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a xml file with multiple nested open tags.

Record
GHSA-6ppq-w2qp-6rhq
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-119
Updated
2026-11-02
OSV 5.5

Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a xml file with multiple nested open tags.

Record
CVE-2016-10040
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-10040 5.5

Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a xml file with multiple nested open tags.

Record
DEBIAN-CVE-2016-10040
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2016-10040 5.5

Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a xml file with multiple nested open tags.

Record
UBUNTU-CVE-2016-10040
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2018-0284 No score

Updated qt3 packages fix security vulnerability

Updated qt3 packages fix security vulnerability:

A stack overflow flaw was found in the way Qt parsed XML input with several nested opening tags. An application using Qt's QXmlSimpleReader to parse specially crafted XML input could crash (CVE-2016-10040).

Record
MGASA-2018-0284
Updated
2026-11-02
OSVSUSE-SU-2018:1902-1 No score

Security update for libqt4

This update for libqt4 fixes the following issues:

LibQt4 was updated to 4.8.7 (bsc#1039291, CVE-2016-10040):

See http://download.qt.io/official_releases/qt/4.8/4.8.7/changes-4.8.7 for more details.

Also libQtWebkit4 was updated to 2.3.4 to match libqt4.

Also following bugs were fixed:

  • Enable libqt4-devel-32bit (bsc#982826)
  • Fixed bolder font in Qt4 apps (boo#956357)
Record
SUSE-SU-2018:1902-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qtbase-opensource-src
Debian:12
 before 5.2.0+dfsg-7
5.2.0+dfsg-7
qtbase-opensource-src
Debian:13
 before 5.2.0+dfsg-7
5.2.0+dfsg-7
qtbase-opensource-src
Debian:14
 before 5.2.0+dfsg-7
5.2.0+dfsg-7
qt3
Mageia:6
 before 3.3.8b-42.1.mga6
3.3.8b-42.1.mga6
libQtWebKit4
SUSE:Linux Enterprise Desktop 12 SP3
 before 4.8.7+2.3.4-4.5.1
4.8.7+2.3.4-4.5.1
libqca2
SUSE:Linux Enterprise Desktop 12 SP3
 before 2.0.3-17.2.1
2.0.3-17.2.1
libqt4
SUSE:Linux Enterprise Desktop 12 SP3
 before 4.8.7-8.6.1
4.8.7-8.6.1
libqt4-sql-plugins
SUSE:Linux Enterprise Desktop 12 SP3
 before 4.8.7-8.6.1
4.8.7-8.6.1
qt4-qtscript
SUSE:Linux Enterprise Desktop 12 SP3
 before 0.2.0-11.2.4
0.2.0-11.2.4
libQtWebKit4
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 4.8.7+2.3.4-4.5.1
4.8.7+2.3.4-4.5.1
Show 18 moreShow less
Affected packages
PackageAffectedFixed
libqca2
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 2.0.3-17.2.1
2.0.3-17.2.1
libqt4
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 4.8.7-8.6.1
4.8.7-8.6.1
libqt4-devel-doc
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 4.8.7-8.6.4
4.8.7-8.6.4
libqt4-sql-plugins
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 4.8.7-8.6.1
4.8.7-8.6.1
libQtWebKit4
SUSE:Linux Enterprise Server 12 SP3
 before 4.8.7+2.3.4-4.5.1
4.8.7+2.3.4-4.5.1
libqca2
SUSE:Linux Enterprise Server 12 SP3
 before 2.0.3-17.2.1
2.0.3-17.2.1
libqt4
SUSE:Linux Enterprise Server 12 SP3
 before 4.8.7-8.6.1
4.8.7-8.6.1
libqt4-devel-doc
SUSE:Linux Enterprise Server 12 SP3
 before 4.8.7-8.6.4
4.8.7-8.6.4
libqt4-sql-plugins
SUSE:Linux Enterprise Server 12 SP3
 before 4.8.7-8.6.1
4.8.7-8.6.1
libQtWebKit4
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 4.8.7+2.3.4-4.5.1
4.8.7+2.3.4-4.5.1
libqca2
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 2.0.3-17.2.1
2.0.3-17.2.1
libqt4
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 4.8.7-8.6.1
4.8.7-8.6.1
libqt4-devel-doc
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 4.8.7-8.6.4
4.8.7-8.6.4
libqt4-sql-plugins
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 4.8.7-8.6.1
4.8.7-8.6.1
libqt4
SUSE:Linux Enterprise Workstation Extension 12 SP3
 before 4.8.7-8.6.1
4.8.7-8.6.1
libqt4-sql-plugins
SUSE:Linux Enterprise Workstation Extension 12 SP3
 before 4.8.7-8.6.1
4.8.7-8.6.1
qt4-qtscript
SUSE:Linux Enterprise Workstation Extension 12 SP3
 before 0.2.0-11.2.4
0.2.0-11.2.4
qt4-x11
Ubuntu:14.04:LTS
 All versions, plus listed versions
4:4.8.4+dfsg-0ubuntu184:4.8.4+dfsg-0ubuntu194:4.8.4+dfsg-0ubuntu204:4.8.4+dfsg-0ubuntu214:4.8.4+dfsg-0ubuntu224:4.8.5+git192-g085f851+dfsg-2ubuntu34:4.8.5+git192-g085f851+dfsg-2ubuntu44:4.8.5+git192-g085f851+dfsg-2ubuntu4.1
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-10040 is a medium vulnerability (CVSS 5.5) in Qt Qxmlsimplereader, published March 7, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.92%, the 80th percentile. Fixed in qtbase-opensource-src 5.2.0+dfsg-7.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open