Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2022-25255: In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
CVE-2022-25255 · published 4 years ago
Summary
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
What to do
- Update canonical qtbase-opensource-src to version 5.12.8+dfsg-0ubuntu2.1+esm3.
- Update debian qt6-base to version 6.2.4+dfsg-4.
- Update debian qtbase-opensource-src to version 5.15.2+dfsg-15.
- Update debian qtbase-opensource-src-gles to version 5.15.4+dfsg-2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | qt | qt |
>= 5.9.0, < 5.15.9 >= 6.0.0, < 6.2.4 cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:* |
| Ubuntu:Pro:20.04:LTS | canonical | qtbase-opensource-src |
< 5.12.8+dfsg-0ubuntu2.1+esm3 Fix: upgrade to 5.12.8+dfsg-0ubuntu2.1+esm3
|
| Ubuntu:22.04:LTS | canonical | qt6-base | All versions |
| Debian:12 | debian | qt6-base |
< 6.2.4+dfsg-4 Fix: upgrade to 6.2.4+dfsg-4
|
| Debian:12 | debian | qtbase-opensource-src |
< 5.15.2+dfsg-15 Fix: upgrade to 5.15.2+dfsg-15
|
| Debian:12 | debian | qtbase-opensource-src-gles |
< 5.15.4+dfsg-2 Fix: upgrade to 5.15.4+dfsg-2
|
Original advisory text
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
References
- https://ubuntu.com/security/CVE-2022-25255 Third Party Advisory
- https://download.qt.io/official_releases/qt/6.2/qprocess6-2.diff Third Party Advisory
- https://codereview.qt-project.org/c/qt/qtbase/+/393113 Third Party Advisory
- https://download.qt.io/official_releases/qt/5.15/qprocess5-15.diff Third Party Advisory
- https://codereview.qt-project.org/c/qt/qtbase/+/396020 Third Party Advisory
- https://codereview.qt-project.org/c/qt/qtbase/+/394914 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-25255 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8076-1 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-25255 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published16 Feb 2022
Updated4 Nov 2026
First seen29 Sep 2026
Track software like this
Free during beta