CVE-2022-25255

In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 20%
VendorProductVersion
qtqt
5.9.0 ≤
𝑥
< 5.15.9
qtqt
6.0.0 ≤
𝑥
< 6.2.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
qt6-base
bookworm
6.4.2+dfsg-10
fixed
buster
ignored
stretch
not-affected
bullseye
no-dsa
sid
6.7.2+dfsg-4
fixed
trixie
6.7.2+dfsg-4
fixed
qtbase-opensource-src
bullseye
5.15.2+dfsg-9+deb11u1
no-dsa
buster
ignored
stretch
not-affected
bookworm
5.15.8+dfsg-11+deb12u2
fixed
sid
5.15.15+dfsg-2
fixed
trixie
5.15.15+dfsg-2
fixed
qtbase-opensource-src-gles
bullseye
no-dsa
buster
ignored
stretch
not-affected
bookworm
5.15.8+dfsg-3
fixed
sid
5.15.15+dfsg-2
fixed
trixie
5.15.15+dfsg-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
qt6-base
noble
needs-triage
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
needs-triage
xenial
ignored
trusty
ignored
qtbase-opensource-src
noble
not-affected
mantic
not-affected
lunar
not-affected
kinetic
not-affected
jammy
not-affected
impish
ignored
focal
needed
bionic
not-affected
xenial
not-affected
trusty
ignored
References
https://codereview.qt-project.org/c/qt/qtbase/+/393113
https://codereview.qt-project.org/c/qt/qtbase/+/394914
https://codereview.qt-project.org/c/qt/qtbase/+/396020
https://download.qt.io/official_releases/qt/5.15/qprocess5-15.diff
https://download.qt.io/official_releases/qt/6.2/qprocess6-2.diff
https://codereview.qt-project.org/c/qt/qtbase/+/393113
https://codereview.qt-project.org/c/qt/qtbase/+/394914
https://codereview.qt-project.org/c/qt/qtbase/+/396020
https://download.qt.io/official_releases/qt/5.15/qprocess5-15.diff
https://download.qt.io/official_releases/qt/6.2/qprocess6-2.diff