{"id":"CVE-2015-0295","aliases":["DEBIAN-CVE-2015-0295","DLA-210-1","EUVD-2015-0308","GHSA-8p7m-hxqm-w38g","MGASA-2015-0105","SUSE-SU-2015:0977-1","SUSE-SU-2015:1359-1","SUSE-SU-2015:1383-1","UBUNTU-CVE-2015-0295","USN-2626-1","openSUSE-SU-2024:10180-1","openSUSE-SU-2024:10287-1","openSUSE-SU-2024:10456-1"],"status":"published","title":"The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract...","description":"The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color components, which allows remote attackers to cause a denial of service (divide-by-zero and crash) via a crafted BMP file.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.06066,"percentile":0.93431,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-189"],"published":"2015-03-12T15:30:53Z","modified":"2026-09-09T06:47:31Z","fixes":[{"ecosystem":"Debian:12","package":"qtbase-opensource-src","fixed_in":["5.3.2+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qtbase-opensource-src","fixed_in":["5.3.2+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qtbase-opensource-src","fixed_in":["5.3.2+dfsg-5"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"qt3","fixed_in":["3.3.8b-33.3.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"qt4","fixed_in":["4.8.6-1.2.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"qtbase5","fixed_in":["5.2.0-2.4.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qt4-x11","fixed_in":["4:4.8.5+git192-g085f851+dfsg-2ubuntu4.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qtbase-opensource-src","fixed_in":["5.2.1+dfsg-1ubuntu14.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libqt5-qtbase","fixed_in":["5.7.0-2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.2+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.2+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.2+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"qt4-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.3-4+squeeze3"}]}],"versions":["4:4.6.3-4","4:4.6.3-4+squeeze1","4:4.6.3-4+squeeze2"],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"qt3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8b-33.3.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"qt4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-1.2.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"qtbase5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-2.4.mga4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"libqt4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"libqt4-sql-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"libqt4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"libqt4-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"libqt4-sql-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"libqt4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"libqt4-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"libqt4-sql-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libqt4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libqt4-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libqt4-sql-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"libqt4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"libqt4-sql-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.6-4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-4.4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-4.4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-4.4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-4.4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qt4-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.8.5+git192-g085f851+dfsg-2ubuntu4.1"}]}],"versions":["4:4.8.4+dfsg-0ubuntu18","4:4.8.4+dfsg-0ubuntu19","4:4.8.4+dfsg-0ubuntu20","4:4.8.4+dfsg-0ubuntu21","4:4.8.4+dfsg-0ubuntu22","4:4.8.5+git192-g085f851+dfsg-2ubuntu3","4:4.8.5+git192-g085f851+dfsg-2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1+dfsg-1ubuntu14.3"}]}],"versions":["5.0.2+dfsg1-7ubuntu11","5.0.2+dfsg1-7ubuntu12","5.0.2+dfsg1-7ubuntu13","5.0.2+dfsg1-7ubuntu14","5.0.2+dfsg1-7ubuntu15","5.0.2+dfsg1-7ubuntu16","5.0.2+dfsg1-7ubuntu17","5.0.2+dfsg1-7ubuntu18","5.2.1+dfsg-1ubuntu7","5.2.1+dfsg-1ubuntu8","5.2.1+dfsg-1ubuntu9","5.2.1+dfsg-1ubuntu10","5.2.1+dfsg-1ubuntu11","5.2.1+dfsg-1ubuntu13","5.2.1+dfsg-1ubuntu14","5.2.1+dfsg-1ubuntu14.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qt4-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.8.5+git192-g085f851+dfsg-2ubuntu4.1"}]}],"versions":["4:4.8.4+dfsg-0ubuntu18","4:4.8.4+dfsg-0ubuntu19","4:4.8.4+dfsg-0ubuntu20","4:4.8.4+dfsg-0ubuntu21","4:4.8.4+dfsg-0ubuntu22","4:4.8.5+git192-g085f851+dfsg-2ubuntu3","4:4.8.5+git192-g085f851+dfsg-2ubuntu4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1+dfsg-1ubuntu14.3"}]}],"versions":["5.0.2+dfsg1-7ubuntu11","5.0.2+dfsg1-7ubuntu12","5.0.2+dfsg1-7ubuntu13","5.0.2+dfsg1-7ubuntu14","5.0.2+dfsg1-7ubuntu15","5.0.2+dfsg1-7ubuntu16","5.0.2+dfsg1-7ubuntu17","5.0.2+dfsg1-7ubuntu18","5.2.1+dfsg-1ubuntu7","5.2.1+dfsg-1ubuntu8","5.2.1+dfsg-1ubuntu9","5.2.1+dfsg-1ubuntu10","5.2.1+dfsg-1ubuntu11","5.2.1+dfsg-1ubuntu13","5.2.1+dfsg-1ubuntu14","5.2.1+dfsg-1ubuntu14.2"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qt3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8c-140.6"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.0-2.2"}]}]}],"products":[{"vendor":"digia","product":"qt"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://www.securityfocus.com/bid/73029","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://lists.qt-project.org/pipermail/announce/2015-February/000059.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151034.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151352.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151138.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150800.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2626-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150940.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151121.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0295"},{"url":"https://github.com/advisories/GHSA-8p7m-hxqm-w38g"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-0295","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0105.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15383","tags":["report"]},{"url":"https://bugreports.qt.io/browse/QTBUG-44547","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150977-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/921999","tags":["report"]},{"url":"https://bugzilla.suse.com/927806","tags":["report"]},{"url":"https://bugzilla.suse.com/927807","tags":["report"]},{"url":"https://bugzilla.suse.com/927808","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1860","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151359-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/847880","tags":["report"]},{"url":"https://bugzilla.suse.com/929688","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151383-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/870151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-0295","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2626-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-0295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1860","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0190","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-0295","description":"The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color components, which allows remote attackers to cause a denial of service (divide-by-zero and crash) via a crafted BMP file.","status":"published","published":"2015-03-25T14:00:00Z","modified":"2024-08-06T04:03:10.962Z","updated_at":"2026-11-02T14:35:45.763329Z"}],"euvd":[{"id":"EUVD-2015-0308","description":"The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color components, which allows remote attackers to cause a denial of service (divide-by-zero and crash) via a crafted BMP file.","status":"published","published":"2015-03-25T14:00:00Z","modified":"2024-08-06T04:03:10Z","updated_at":"2026-11-03T02:22:20.481932Z"}],"ghsa":[{"id":"GHSA-8p7m-hxqm-w38g","title":"The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract...","description":"The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color components, which allows remote attackers to cause a denial of service (divide-by-zero and crash) via a crafted BMP file.","status":"published","published":"2022-05-14T02:09:44Z","modified":"2023-02-02T05:05:01Z","updated_at":"2026-11-02T14:52:00.521272Z"}],"nvd":[{"id":"CVE-2015-0295","description":"The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color components, which allows remote attackers to cause a denial of service (divide-by-zero and crash) via a crafted BMP file.","status":"published","published":"2015-03-25T14:59:01.72Z","modified":"2026-06-17T00:19:56.153Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:03:03.313464Z"}],"osv":[{"id":"CVE-2015-0295","description":"The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color components, which allows remote attackers to cause a denial of service (divide-by-zero and crash) via a crafted BMP file.","status":"published","published":"2015-03-25T14:59:01Z","modified":"2026-04-16T06:21:40.890731104Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2015-0295","description":"The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color components, which allows remote attackers to cause a denial of service (divide-by-zero and crash) via a crafted BMP file.","status":"published","published":"2015-03-25T14:59:01.72Z","modified":"2026-09-09T06:47:31.875942684Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"DLA-210-1","title":"qt4-x11 - security update","status":"published","published":"2015-04-29T00:00:00Z","modified":"2026-03-09T01:18:59.50687Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2015-0105","title":"Updated qt3, qt4 and qtbase5 packages fix security vulnerability","description":"The builtin BMP decoder in QtGui prior to Qt 5.5 contained a bug that would\nlead to a divsion by zero when loading certain corrupt BMP files (CVE-2015-0295).\nThis in turn would cause the application loading these hand crafted BMPs to crash.\nQt3, Qt4 and qtbase5 have been patched to prevent this division by zero.\n","status":"published","published":"2015-03-12T15:30:53Z","modified":"2026-04-16T06:23:01.132622223Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10180-1","title":"libqt4-32bit-4.8.7-5.4 on GA media","description":"These are all security issues fixed in the libqt4-32bit-4.8.7-5.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:34:43.783361Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10287-1","title":"qt3-3.3.8c-140.6 on GA media","description":"These are all security issues fixed in the qt3-3.3.8c-140.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:54.745373Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10456-1","title":"libQt5Bootstrap-devel-static-32bit-5.7.0-2.2 on GA media","description":"These are all security issues fixed in the libQt5Bootstrap-devel-static-32bit-5.7.0-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:39:42.085255Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2015:0977-1","title":"Security update for libqt4","description":"\nThe libqt4 library was updated to fix several security issues:\n\n    * CVE-2015-0295: Division by zero when processing malformed BMP files.\n      (bsc#921999)\n    * CVE-2015-1858: Segmentation fault in BMP Qt Image Format Handling.\n      (bsc#927806)\n    * CVE-2015-1859: Segmentation fault in ICO Qt Image Format Handling.\n      (bsc#927807)\n    * CVE-2015-1860: Segmentation fault in GIF Qt Image Format Handling.\n      (bsc#927808)\n\nSecurity Issues:\n\n    * CVE-2015-1858\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1858\u003e\n    * CVE-2015-1859\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1859\u003e\n    * CVE-2015-1860\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1860\u003e\n    * CVE-2015-0295\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0295\u003e\n\n","status":"published","published":"2015-05-12T16:07:43Z","modified":"2025-05-02T04:04:20.963533Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1359-1","title":"Security update for libqt4","description":"The libqt4 library was updated to fix several security and non security issues.\n\nThe following vulnerabilities were fixed:\n- bsc#921999: CVE-2015-0295: division by zero when processing malformed BMP files\n- bsc#927806: CVE-2015-1858: segmentation fault in BMP Qt Image Format Handling\n- bsc#927807: CVE-2015-1859: segmentation fault in ICO Qt Image Format Handling\n- bsc#927808: CVE-2015-1860: segmentation fault in GIF Qt Image Format Handling\n\nThe following non-secuirty issues were fixed:\n- bsc#929688: Critical Problem in Qt Network Stack\n- bsc#847880: kde/qt rendering error in qemu cirrus i586\n- Update use-freetype-default.diff to use same method as with\n  libqt5-qtbase package: Qt itself already does runtime check\n  whether subpixel rendering is available, but only when\n  FT_CONFIG_OPTION_SUBPIXEL_RENDERING is defined. Thus it is enough\n  to only remove that condition\n- The -devel subpackage requires Mesa-devel, not only at build time \n- Fixed compilation on SLE_11_SP3 by making it build against\n  Mesa-devel on that system\n- Replace patch l-qclipboard_fix_recursive.patch with\n  qtcore-4.8.5-qeventdispatcher-recursive.patch. The later one \n  seems to work better and really resolves the issue in LibreOffice\n- Added kde4_qt_plugin_path.patch, so kde4 plugins are magically\n  found/known outside kde4 enviroment/session\n- added _constraints. building took up to 7GB of disk space on\n  s390x, and more than 6GB on x86_64 \n- Add 3 patches for Qt bugs to make LibreOffice KDE4 file\n  picker work properly again:\n  * Add glib-honor-ExcludeSocketNotifiers-flag.diff (QTBUG-37380)\n  * Add l-qclipboard_fix_recursive.patch (QTBUG-34614)\n  * Add l-qclipboard_delay.patch (QTBUG-38585)","status":"published","published":"2015-05-27T13:53:24Z","modified":"2026-02-04T03:29:43.341614Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:1383-1","title":"Security update for libqt5-qtbase","description":"\nThis security update fixes the following issues:\n\n * Add libqt5-Fix-a-division-by-zero-processing-malformed-BMP.patch\n   - QTBUG-44547, bsc#921999 (CVE-2015-0295)\n * Add libqt5-Fixes-crash-in-bmp-and-ico-image-decoding.patch\n   - bsc#927806 (CVE-2015-1858), bsc#927807 (CVE-2015-1859)\n * Add libqt5-Fixes-crash-in-gif-image-decoder.patch\n   - bsc#927808 (CVE-2015-1860)\n * Add libqt5-fix-use-after-free-bug.patch from upstream\n   - fixes the use-after-free bug in backingstore, boo#870151\n","status":"published","published":"2015-05-29T17:35:18Z","modified":"2026-02-04T04:20:02.105032Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2015-0295","description":"The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color components, which allows remote attackers to cause a denial of service (divide-by-zero and crash) via a crafted BMP file.","status":"published","published":"2015-03-25T00:00:00Z","modified":"2026-04-22T10:00:30.029626Z","updated_at":"2026-11-02T15:54:09.721803Z"},{"id":"USN-2626-1","title":"qt4-x11, qtbase-opensource-src vulnerabilities","description":"Wolfgang Schenk discovered that Qt incorrectly handled certain malformed\nGIF images. If a user or automated system were tricked into opening a\nspecially crafted GIF image, a remote attacker could use this issue to\ncause Qt to crash, resulting in a denial of service. This issue only\napplied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-0190)\n\nFabian Vogt discovered that Qt incorrectly handled certain malformed BMP\nimages. If a user or automated system were tricked into opening a specially\ncrafted BMP image, a remote attacker could use this issue to cause Qt to\ncrash, resulting in a denial of service. (CVE-2015-0295)\n\nRichard Moore and Fabian Vogt discovered that Qt incorrectly handled\ncertain malformed BMP images. If a user or automated system were tricked\ninto opening a specially crafted BMP image, a remote attacker could use\nthis issue to cause Qt to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2015-1858)\n\nRichard Moore and Fabian Vogt discovered that Qt incorrectly handled\ncertain malformed ICO images. If a user or automated system were tricked\ninto opening a specially crafted ICO image, a remote attacker could use\nthis issue to cause Qt to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2015-1859)\n\nRichard Moore and Fabian Vogt discovered that Qt incorrectly handled\ncertain malformed GIF images. If a user or automated system were tricked\ninto opening a specially crafted GIF image, a remote attacker could use\nthis issue to cause Qt to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2015-1860)\n","status":"published","published":"2015-06-03T13:33:12Z","modified":"2026-04-22T09:13:09.076602Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}