PT-2005-1084 · Qt · Qt

Tavis Ormandy · Published 2005-03-01 · Updated 2008-09-05 · CVE-2005-0627

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Qt versions prior to 3.3.4

Description The issue allows local users to execute arbitrary programs due to Qt searching the BUILD PREFIX directory, which could be world-writable, to load shared libraries regardless of the LD LIBRARY PATH environment variable. This could lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be performed locally.

Recommendations For Qt versions prior to 3.3.4, update to version 3.3.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the BUILD PREFIX directory to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-09472

CVE-2005-0627

Affected Products

Qt

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-0627 · Security Note
• http://gentoo.org/security/en/glsa/glsa-200503-01.xml · Vendor Advisory
• http://securityfocus.com/bid/12695 · Patch
• https://bdu.fstec.ru/vul/2015-09472 · Security Note
• http://bugs.gentoo.org/show_bug.cgi?id=75181 · Patch
• http://security.gentoo.org/glsa/glsa-200503-01.xml · Note