CVE-2015-1858

Name	CVE-2015-1858
Description	Multiple buffer overflows in gui/image/qbmphandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted BMP image.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-210-1
Debian Bugs	783133, 783134

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
qtbase-opensource-src (PTS)	bullseye	5.15.2+dfsg-9+deb11u1	fixed
	bookworm	5.15.8+dfsg-11+deb12u2	fixed
	sid, trixie	5.15.15+dfsg-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
qt4-x11	source	squeeze	4:4.6.3-4+squeeze3	DLA-210-1
qt4-x11	source	jessie	4:4.8.6+git64-g5dc8b2b+dfsg-3+deb8u1
qt4-x11	source	(unstable)	4:4.8.6+git155-g716fbae+dfsg-2		783133
qtbase-opensource-src	source	jessie	5.3.2+dfsg-4+deb8u1
qtbase-opensource-src	source	(unstable)	5.3.2+dfsg-5		783134

[wheezy] - qt4-x11 <no-dsa> (Minor issue)
http://lists.qt-project.org/pipermail/announce/2015-April/000067.html