CVE-2014-0190

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values in a GIF image.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:N/A:P

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134040.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134141.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132395.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.htmlThird Party Advisory
http://lists.qt-project.org/pipermail/announce/2014-April/000045.htmlVendor Advisory
http://www.securityfocus.com/bid/67087Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2626-1Third Party Advisory
https://bugs.kde.org/show_bug.cgi?id=333404Issue Tracking, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134040.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134141.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132395.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.htmlThird Party Advisory
http://lists.qt-project.org/pipermail/announce/2014-April/000045.htmlVendor Advisory
http://www.securityfocus.com/bid/67087Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2626-1Third Party Advisory
https://bugs.kde.org/show_bug.cgi?id=333404Issue Tracking, Third Party Advisory

Timeline

Published: May 8, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-01914.3The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion CVE-2014-01925.0Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sens CVE-2014-01935.0WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 all CVE-2014-01956.8The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properl CVE-2014-01965.5The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO CVE-2014-01978.8CFME: CSRF protection vulnerability via permissive check of the referrer header CVE-2014-01984.3The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a b CVE-2014-01992.1The setup script in ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports (rhevm-reports) package before 3.3.3, sto CVE-2014-02002.1The Red Hat Enterprise Virtualization Manager reports (rhevm-reports) package before 3.3.3-1 uses world-readable permissions on the datasour CVE-2014-02012.1ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports package (rhevm-reports) before 3.3.3, uses world-readable per CVE-2014-02022.1The setup script in ovirt-engine-dwh, as used in the Red Hat Enterprise Virtualization Manager data warehouse (rhevm-dwh) package before 3.3 CVE-2014-02035.5The __do_follow_link function in fs/namei.c in the Linux kernel before 2.6.33 does not properly handle the last pathname component during us