What’s Vulnerable › Vulnerabilities

CVE-2014-0190

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-05-08 · updated 2026-06-17
• Weakness: CWE-476

Description

The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values in a GIF image.

Affected products

• Canonical Ubuntu Linux: 12.04, 14.04, 14.10, 15.04
• Fedoraproject Fedora: 19, 20
• Opensuse: 13.1
• Qt: before 5.3.0 — fixed in 5.3.0

How to fix

Upgrade to a fixed version: Qt 5.3.0. Check the vendor advisory for mitigations.

References

• http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134040.html
• http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134141.html
• http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132395.html
• http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.html
• http://lists.qt-project.org/pipermail/announce/2014-April/000045.html
• http://www.securityfocus.com/bid/67087
• http://www.ubuntu.com/usn/USN-2626-1
• https://bugs.kde.org/show_bug.cgi?id=333404
• http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134040.html
• http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134141.html
• http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132395.html
• http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.html

Get alerted when CVE-2014-0190 or the next vulnerability affects your stack