CVE-2015-1858

Multiple buffer overflows in gui/image/qbmphandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted BMP image.

• CWE-119

• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155424.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155927.htmlPatch, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155962.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155976.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156727.htmlThird Party Advisory
• http://lists.qt-project.org/pipermail/announce/2015-April/000067.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/74309Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2626-1
• https://codereview.qt-project.org/#/c/108312/Patch
• https://security.gentoo.org/glsa/201603-10
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155424.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155927.htmlPatch, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155962.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155976.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156727.htmlThird Party Advisory
• http://lists.qt-project.org/pipermail/announce/2015-April/000067.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/74309Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2626-1
• https://codereview.qt-project.org/#/c/108312/Patch
• https://security.gentoo.org/glsa/201603-10

Published

May 12, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-1852The s3_token middleware in OpenStack keystonemiddleware befo…
• CVE-2015-1853chrony before 1.31.1 does not properly protect state variabl…6.5
• CVE-2015-1854389 Directory Server before 1.3.3.10 allows attackers to byp…
• CVE-2015-1855verify_certificate_identity in the OpenSSL extension in Ruby…5.9
• CVE-2015-1856OpenStack Object Storage (Swift) before 2.3.0, when allow_ve…
• CVE-2015-1857The odl-mdsal-apidocs feature in OpenDaylight Helium allow r…5.3
• CVE-2015-1859Multiple buffer overflows in plugins/imageformats/ico/qicoha…
• CVE-2015-1860Multiple buffer overflows in gui/image/qgifhandler.cpp in th…
• CVE-2015-1861Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-1862The crash reporting feature in Abrt allows local users to ga…
• CVE-2015-1863Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4…
• CVE-2015-1864Multiple cross-site scripting (XSS) vulnerabilities in the a…