{"id":"CVE-2014-0190","aliases":["EUVD-2014-0242","GHSA-9r7x-qv26-9x2m","MGASA-2014-0240","MGASA-2014-0241","MGASA-2014-0263","UBUNTU-CVE-2014-0190","USN-2626-1","openSUSE-SU-2024:10180-1"],"status":"published","title":"The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service ...","description":"The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values in a GIF image.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03957,"percentile":0.90512,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2014-05-08T00:00:00Z","modified":"2026-06-17T00:02:28Z","fixes":[{"ecosystem":"Mageia:3","package":"qt4","fixed_in":["4.8.6-1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"qt4","fixed_in":["4.8.6-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"qtbase5","fixed_in":["5.2.0-2.3.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qt4-x11","fixed_in":["4:4.8.5+git192-g085f851+dfsg-2ubuntu4.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qtbase-opensource-src","fixed_in":["5.2.1+dfsg-1ubuntu14.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:3","package":"qt4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"qt4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"qtbase5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-2.3.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"qt3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8b-32.1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"qt3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8b-33.2.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qt4-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.8.5+git192-g085f851+dfsg-2ubuntu4.1"}]}],"versions":["4:4.8.4+dfsg-0ubuntu18","4:4.8.4+dfsg-0ubuntu19","4:4.8.4+dfsg-0ubuntu20","4:4.8.4+dfsg-0ubuntu21","4:4.8.4+dfsg-0ubuntu22","4:4.8.5+git192-g085f851+dfsg-2ubuntu3","4:4.8.5+git192-g085f851+dfsg-2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1+dfsg-1ubuntu14.3"}]}],"versions":["5.0.2+dfsg1-7ubuntu11","5.0.2+dfsg1-7ubuntu12","5.0.2+dfsg1-7ubuntu13","5.0.2+dfsg1-7ubuntu14","5.0.2+dfsg1-7ubuntu15","5.0.2+dfsg1-7ubuntu16","5.0.2+dfsg1-7ubuntu17","5.0.2+dfsg1-7ubuntu18","5.2.1+dfsg-1ubuntu7","5.2.1+dfsg-1ubuntu8","5.2.1+dfsg-1ubuntu9","5.2.1+dfsg-1ubuntu10","5.2.1+dfsg-1ubuntu11","5.2.1+dfsg-1ubuntu13","5.2.1+dfsg-1ubuntu14","5.2.1+dfsg-1ubuntu14.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qt4-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.8.5+git192-g085f851+dfsg-2ubuntu4.1"}]}],"versions":["4:4.8.4+dfsg-0ubuntu18","4:4.8.4+dfsg-0ubuntu19","4:4.8.4+dfsg-0ubuntu20","4:4.8.4+dfsg-0ubuntu21","4:4.8.4+dfsg-0ubuntu22","4:4.8.5+git192-g085f851+dfsg-2ubuntu3","4:4.8.5+git192-g085f851+dfsg-2ubuntu4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1+dfsg-1ubuntu14.3"}]}],"versions":["5.0.2+dfsg1-7ubuntu11","5.0.2+dfsg1-7ubuntu12","5.0.2+dfsg1-7ubuntu13","5.0.2+dfsg1-7ubuntu14","5.0.2+dfsg1-7ubuntu15","5.0.2+dfsg1-7ubuntu16","5.0.2+dfsg1-7ubuntu17","5.0.2+dfsg1-7ubuntu18","5.2.1+dfsg-1ubuntu7","5.2.1+dfsg-1ubuntu8","5.2.1+dfsg-1ubuntu9","5.2.1+dfsg-1ubuntu10","5.2.1+dfsg-1ubuntu11","5.2.1+dfsg-1ubuntu13","5.2.1+dfsg-1ubuntu14","5.2.1+dfsg-1ubuntu14.2"],"bundled":5}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"qt","product":"qt"}],"references":[{"url":"https://bugs.kde.org/show_bug.cgi?id=333404","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134040.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2626-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory"]},{"url":"http://lists.qt-project.org/pipermail/announce/2014-April/000045.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","web","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134141.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132395.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/67087","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0190"},{"url":"https://github.com/advisories/GHSA-9r7x-qv26-9x2m"},{"url":"https://advisories.mageia.org/MGASA-2014-0240.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13276","tags":["report"]},{"url":"http://blog.qt.digia.com/blog/2014/04/24/qt-4-8-6-released/","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-May/132395.html","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0241.html","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-May/132648.html","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0263.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13509","tags":["report"]},{"url":"http://lists.qt-project.org/pipermail/announce/2013-December/000036.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-January/127076.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-June/134040.html","tags":["web"]},{"url":"http://advisories.mageia.org/MGASA-2014-0009.html","tags":["advisory"]},{"url":"http://advisories.mageia.org/MGASA-2014-0240.html","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-0190","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/04/28","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2626-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-0295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1860","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1860","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-0190","description":"The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values in a GIF image.","status":"published","published":"2014-05-08T14:00:00Z","modified":"2024-08-06T09:05:39.205Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2014-0242","description":"The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values in a GIF image.","status":"published","published":"2014-05-08T14:00:00Z","modified":"2024-08-06T09:05:39Z","updated_at":"2026-11-03T01:57:22.468358Z"}],"ghsa":[{"id":"GHSA-9r7x-qv26-9x2m","title":"The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service ...","description":"The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values in a GIF image.","status":"published","published":"2022-05-13T01:09:17Z","modified":"2023-02-01T05:03:31Z","cwes":["CWE-476"],"updated_at":"2026-11-02T14:50:03.88435Z"}],"nvd":[{"id":"CVE-2014-0190","description":"The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values in a GIF image.","status":"published","published":"2014-05-08T14:29:13.953Z","modified":"2026-06-17T00:02:28.123Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:02:54.082915Z"}],"osv":[{"id":"MGASA-2014-0240","title":"Updated qt4 packages fix security vulnerability","description":"A NULL pointer dereference flaw was found in QGIFFormat::fillRect in QtGui.\nIf an application using the qt-x11 libraries opened a malicious GIF file with\ninvalid width and height values, it could cause the application to crash\n(CVE-2014-0190).\n\nQt4 has been patched to correct this flaw and has been updated to version\n4.8.6, which fixes several other bugs.\n","status":"published","published":"2014-05-29T06:52:08Z","modified":"2026-04-16T06:23:05.698591418Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0241","title":"Updated qt4 and qtbase5 packages fix security vulnerability","description":"A NULL pointer dereference flaw was found in QGIFFormat::fillRect in QtGui.\nIf an application using the qt-x11 libraries opened a malicious GIF file with\ninvalid width and height values, it could cause the application to crash\n(CVE-2014-0190).\n\nQt4 has been patched to correct this flaw and has been updated to version\n4.8.6, which fixes several other bugs.\n\nQtbase5 has also been patched to correct this flaw.\n","status":"published","published":"2014-05-29T06:55:31Z","modified":"2026-04-16T06:25:31.270511525Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0263","title":"Updated qt3 packages fix security vulnerabilities","description":"Updated qt3 packages fix security vulnerabilities:\n\nQXmlSimpleReader in Qt versions prior to 5.2 supports expansion of\ninternal entities in XML documents without placing restrictions to\nensure the document does not cause excessive memory usage. If an\napplication using this API processes untrusted data then the\napplication may use unexpected amounts of memory if a malicious\ndocument is processed (CVE-2013-4549).\n\nA NULL pointer dereference flaw was found in QGIFFormat::fillRect in\nQtGui. If an application using the qt-x11 libraries opened a malicious\nGIF file with invalid width and height values, it could cause the\napplication to crash (CVE-2014-0190)..\n","status":"published","published":"2014-06-18T18:02:44Z","modified":"2026-04-16T06:23:45.437968337Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10180-1","title":"libqt4-32bit-4.8.7-5.4 on GA media","description":"These are all security issues fixed in the libqt4-32bit-4.8.7-5.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:34:43.783361Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"UBUNTU-CVE-2014-0190","description":"The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values in a GIF image.","status":"published","published":"2014-05-08T00:00:00Z","modified":"2026-04-22T09:28:50.251987Z","updated_at":"2026-11-02T15:54:07.855521Z"},{"id":"USN-2626-1","title":"qt4-x11, qtbase-opensource-src vulnerabilities","description":"Wolfgang Schenk discovered that Qt incorrectly handled certain malformed\nGIF images. If a user or automated system were tricked into opening a\nspecially crafted GIF image, a remote attacker could use this issue to\ncause Qt to crash, resulting in a denial of service. This issue only\napplied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-0190)\n\nFabian Vogt discovered that Qt incorrectly handled certain malformed BMP\nimages. If a user or automated system were tricked into opening a specially\ncrafted BMP image, a remote attacker could use this issue to cause Qt to\ncrash, resulting in a denial of service. (CVE-2015-0295)\n\nRichard Moore and Fabian Vogt discovered that Qt incorrectly handled\ncertain malformed BMP images. If a user or automated system were tricked\ninto opening a specially crafted BMP image, a remote attacker could use\nthis issue to cause Qt to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2015-1858)\n\nRichard Moore and Fabian Vogt discovered that Qt incorrectly handled\ncertain malformed ICO images. If a user or automated system were tricked\ninto opening a specially crafted ICO image, a remote attacker could use\nthis issue to cause Qt to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2015-1859)\n\nRichard Moore and Fabian Vogt discovered that Qt incorrectly handled\ncertain malformed GIF images. If a user or automated system were tricked\ninto opening a specially crafted GIF image, a remote attacker could use\nthis issue to cause Qt to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2015-1860)\n","status":"published","published":"2015-06-03T13:33:12Z","modified":"2026-04-22T09:13:09.076602Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}