QT Library up to 5.9.9/5.12.6/5.13.x Search Path untrusted search path

Summaryinfo

A vulnerability identified as critical has been detected in QT Library up to 5.9.9/5.12.6/5.13.x. Affected by this vulnerability is an unknown functionality. Performing a manipulation as part of Search Path results in untrusted search path. This vulnerability is known as CVE-2020-0570. Attacking locally is a requirement. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in QT Library up to 5.9.9/5.12.6/5.13.x (Software Library). It has been classified as critical. This affects some unknown functionality. The manipulation as part of a Search Path leads to a untrusted search path vulnerability. CWE is classifying the issue as CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potentially enable elevation of privilege via local access.

The weakness was published 09/14/2020 as Bug 1800604 as not defined bug report (Bugzilla). The advisory is shared at bugzilla.redhat.com. This vulnerability is uniquely identified as CVE-2020-0570 since 10/28/2019. An attack has to be approached locally. A authentication is required for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1574 for this issue.

Upgrading to version 5.9.10, 5.12.7 or 5.14.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Software Library

Name

• QT Library

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9
• 5.9.0
• 5.9.1
• 5.9.2
• 5.9.3
• 5.9.4
• 5.9.5
• 5.9.6
• 5.9.7
• 5.9.8
• 5.9.9
• 5.10
• 5.11
• 5.12
• 5.12.0
• 5.12.1
• 5.12.2
• 5.12.3
• 5.12.4
• 5.12.5
• 5.12.6
• 5.13

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion