PT-2005-1084 · Qt · Qt

Tavis Ormandy · Publicado 2005-03-01 · Atualizado 2008-09-05 · CVE-2005-0627

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Qt versions prior to 3.3.4

Description The issue allows local users to execute arbitrary programs due to Qt searching the BUILD PREFIX directory, which could be world-writable, to load shared libraries regardless of the LD LIBRARY PATH environment variable. This could lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be performed locally.

Recommendations For Qt versions prior to 3.3.4, update to version 3.3.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the BUILD PREFIX directory to minimize the risk of exploitation.

Correção

Identificadores relacionados

BDU:2015-09472

CVE-2005-0627

Produtos afetados

Qt

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-0627 · Nota de Segurança
• http://gentoo.org/security/en/glsa/glsa-200503-01.xml · Aviso do Fabricante
• http://securityfocus.com/bid/12695 · Correção
• https://bdu.fstec.ru/vul/2015-09472 · Nota de Segurança
• http://bugs.gentoo.org/show_bug.cgi?id=75181 · Correção
• http://security.gentoo.org/glsa/glsa-200503-01.xml · Nota