Command Execution Vulnerability in Qt on Linux and UNIX
CVE-2022-25255

7.8HIGH

Key Information:

Vendor

Qt

Status
Qt
Vendor
CVE Published:
16 February 2022

What is CVE-2022-25255?

A vulnerability in versions of the Qt framework allows the QProcess class to execute a binary from the current working directory if a program is not found in the system PATH. This could pose significant security risks, as it may allow unauthorized code execution within specific contexts on Linux and UNIX systems, potentially leading to further exploitation.

References

https://codereview.qt-project.org/c/qt/qtbase/+/393113
x_refsource_MISC
https://codereview.qt-project.org/c/qt/qtbase/+/394914
x_refsource_MISC
https://download.qt.io/official_releases/qt/6.2/qprocess6...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.