Read the docs
TI-2007-00233 Aliases CVE-2007-0242GHSA-4hj5-9h7j-98c6

The UTF-8 decoder in codecs/qutfcodec.cpp in Qt 3.3.8 and 4.2.3 does not reject long…

Priority LOW 24Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The UTF-8 decoder in codecs/qutfcodec.cpp in Qt 3.3.8 and 4.2.3 does not reject long UTF-8 sequences as required by the standard, which allows remote attackers to conduct cross-site scripting (XSS) and directory traversal attacks via long sequences that decode to dangerous metacharacters.

Why it matters now

EPSS 0.0212 81st percentileScored 2026-11-07
Fix Fixed Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:qt:qt:3.3.8:*:*:*:*:*:*:*3.3.8Vulnerableqt
cpe:2.3:a:qt:qt:4.2.3:*:*:*:*:*:*:*4.2.3Vulnerableqt
  • cpe:2.3:a:qt:qt:3.3.8:*:*:*:*:*:*:* Versions 3.3.8 Vulnerable ·qt
  • cpe:2.3:a:qt:qt:4.2.3:*:*:*:*:*:*:* Versions 4.2.3 Vulnerable ·qt

Remediation

Red Hat 3 advisories

  • RHSA-2011:1324 Released 2011-09-21 · Red Hat rating Moderate
    qt4 security update
    • RHEL Desktop Workstation (v. 5 client) qt4-4.2.1-1.el5_7.1, qt4-devel-4.2.1-1.el5_7.1, qt4-devel-4.2.1-1.el5_7.1.i386
    • Red Hat Enterprise Linux (v. 5 server) qt4-4.2.1-1.el5_7.1, qt4-4.2.1-1.el5_7.1.i386, qt4-4.2.1-1.el5_7.1.ia64 +25
    • Red Hat Enterprise Linux Desktop (v. 5 client) qt4-4.2.1-1.el5_7.1, qt4-4.2.1-1.el5_7.1.i386, qt4-doc-4.2.1-1.el5_7.1 +9
  • RHSA-2007:0909 Released 2007-10-08 · Red Hat rating Moderate
    kdelibs security update
    • Red Hat Enterprise Linux (v. 5 server) kdelibs-6:3.5.4-13.el5, kdelibs-6:3.5.4-13.el5.i386, kdelibs-6:3.5.4-13.el5.ia64 +9
    • Red Hat Enterprise Linux AS version 4 kdelibs-6:3.3.1-9.el4, kdelibs-6:3.3.1-9.el4.i386, kdelibs-6:3.3.1-9.el4.ia64 +5
    • Red Hat Enterprise Linux Desktop (v. 5 client) kdelibs-6:3.5.4-13.el5, kdelibs-6:3.5.4-13.el5.i386, kdelibs-apidocs-6:3.5.4-13.el5 +1
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) kdelibs-6:3.5.4-13.el5, kdelibs-devel-6:3.5.4-13.el5, kdelibs-devel-6:3.5.4-13.el5.i386
    • Red Hat Enterprise Linux Desktop version 4 kdelibs-6:3.3.1-9.el4, kdelibs-6:3.3.1-9.el4.i386, kdelibs-devel-6:3.3.1-9.el4 +1
    • Red Hat Enterprise Linux ES version 4 kdelibs-6:3.3.1-9.el4, kdelibs-6:3.3.1-9.el4.i386, kdelibs-6:3.3.1-9.el4.ia64 +3
    • Red Hat Enterprise Linux WS version 4 kdelibs-6:3.3.1-9.el4, kdelibs-6:3.3.1-9.el4.i386, kdelibs-6:3.3.1-9.el4.ia64 +3
  • RHSA-2007:0883 Released 2007-09-13 · Red Hat rating Important
    qt security update
    • Red Hat Desktop version 3 qt-1:3.1.2-17.RHEL3, qt-1:3.1.2-17.RHEL3.i386, qt-MySQL-1:3.1.2-17.RHEL3 +9
    • Red Hat Enterprise Linux (v. 5 server) qt-1:3.3.6-23.el5, qt-1:3.3.6-23.el5.i386, qt-1:3.3.6-23.el5.ia64 +29
    • Red Hat Enterprise Linux AS (Advanced Server) version 2.1 qt-1:2.3.1-14.EL2, qt-1:2.3.1-14.EL2.i386, qt-1:2.3.1-14.EL2.ia64 +8
    • Red Hat Enterprise Linux AS version 3 qt-1:3.1.2-17.RHEL3, qt-1:3.1.2-17.RHEL3.i386, qt-1:3.1.2-17.RHEL3.ia64 +21
    • Red Hat Enterprise Linux AS version 4 qt-1:3.3.3-13.RHEL4, qt-1:3.3.3-13.RHEL4.i386, qt-1:3.3.3-13.RHEL4.ia64 +25
    • Red Hat Enterprise Linux Desktop (v. 5 client) qt-1:3.3.6-23.el5, qt-1:3.3.6-23.el5.i386, qt-MySQL-1:3.3.6-23.el5 +7
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) qt-1:3.3.6-23.el5, qt-designer-1:3.3.6-23.el5, qt-designer-1:3.3.6-23.el5.i386 +4
    • Red Hat Enterprise Linux Desktop version 4 qt-1:3.3.3-13.RHEL4, qt-1:3.3.3-13.RHEL4.i386, qt-MySQL-1:3.3.3-13.RHEL4 +11
    • Red Hat Enterprise Linux ES version 2.1 qt-1:2.3.1-14.EL2, qt-1:2.3.1-14.EL2.i386, qt-Xt-1:2.3.1-14.EL2.i386 +3
    • Red Hat Enterprise Linux ES version 3 qt-1:3.1.2-17.RHEL3, qt-1:3.1.2-17.RHEL3.i386, qt-1:3.1.2-17.RHEL3.ia64 +15
    • Red Hat Enterprise Linux ES version 4 qt-1:3.3.3-13.RHEL4, qt-1:3.3.3-13.RHEL4.i386, qt-1:3.3.3-13.RHEL4.ia64 +18
    • Red Hat Enterprise Linux WS version 2.1 qt-1:2.3.1-14.EL2, qt-1:2.3.1-14.EL2.i386, qt-Xt-1:2.3.1-14.EL2.i386 +3
    • Red Hat Enterprise Linux WS version 3 qt-1:3.1.2-17.RHEL3, qt-1:3.1.2-17.RHEL3.i386, qt-1:3.1.2-17.RHEL3.ia64 +15
    • Red Hat Enterprise Linux WS version 4 qt-1:3.3.3-13.RHEL4, qt-1:3.3.3-13.RHEL4.i386, qt-1:3.3.3-13.RHEL4.ia64 +18
    • Red Hat Linux Advanced Workstation 2.1 qt-1:2.3.1-14.EL2, qt-1:2.3.1-14.EL2.ia64, qt-Xt-1:2.3.1-14.EL2.ia64 +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHEL Desktop Workstation (v. 5 client)Fixed RHSA-2011:1324
Red Hat Desktop version 3Fixed RHSA-2007:0883
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2007:0883, RHSA-2007:0909, RHSA-2011:1324
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 Fixed RHSA-2007:0883
Red Hat Enterprise Linux AS version 3Fixed RHSA-2007:0883
Red Hat Enterprise Linux AS version 4Fixed RHSA-2007:0883, RHSA-2007:0909
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2007:0883, RHSA-2007:0909, RHSA-2011:1324
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2007:0883, RHSA-2007:0909
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2007:0883, RHSA-2007:0909
Red Hat Enterprise Linux ES version 2.1Fixed RHSA-2007:0883
Red Hat Enterprise Linux ES version 3Fixed RHSA-2007:0883
Red Hat Enterprise Linux ES version 4Fixed RHSA-2007:0883, RHSA-2007:0909
Red Hat Enterprise Linux WS version 2.1Fixed RHSA-2007:0883
Red Hat Enterprise Linux WS version 3Fixed RHSA-2007:0883
Red Hat Enterprise Linux WS version 4Fixed RHSA-2007:0883, RHSA-2007:0909
Red Hat Linux Advanced Workstation 2.1Fixed RHSA-2007:0883

Timeline

  1. 2026-10-02 Threatist record created from CVE-2007-0242
  2. 2026-10-03 Alias added: GHSA-4hj5-9h7j-98c6

References

Patch 1

Advisory 11

Other 7

  • TI-2024-23902 QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x… CVSS 3.1CRITICAL 9.8
  • TI-2022-21359 Heap-based buffer overflow in Qt CVSS 3.1HIGH 8.8
  • TI-2022-19524 Integer overflow in Qt CVSS 3.1HIGH 8.8
  • TI-2023-18997 In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can… CVSS 3.1HIGH 7.5
  • TI-2021-09305 Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0… CVSS 3.1MEDIUM 5.5
  • TI-2023-28356 An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before… CVSS 3.1CRITICAL 9.8
See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences