CVE-2022-25255: High severity Qt QT vulnerability
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qt6-baseto a version that resolves this vulnerability.Fixed in 6.4.2+dfsg-10Fixed in 6.8.2+dfsg-9+deb13u2Fixed in 6.11.2+dfsg-7 - Upgrade
Upgrade
debian/qtbase-opensource-srcto a version that resolves this vulnerability.Fixed in 5.15.8+dfsg-11+deb12u3Fixed in 5.15.15+dfsg-6+deb13u1Fixed in 5.15.19+dfsg-6 - Upgrade
Upgrade
debian/qtbase-opensource-src-glesto a version that resolves this vulnerability.Fixed in 5.15.8+dfsg-3Fixed in 5.15.15+dfsg-2Fixed in 5.15.19+dfsg-2 - Upgrade
Upgrade
debian/qt6-baseto a version that resolves this vulnerability.Fixed in 6.2.4+dfsg-4 - Upgrade
Upgrade
debian/qtbase-opensource-srcto a version that resolves this vulnerability.Fixed in 5.15.2+dfsg-15 - Upgrade
Upgrade
debian/qtbase-opensource-src-glesto a version that resolves this vulnerability.Fixed in 5.15.4+dfsg-2 - Upgrade
Upgrade
redhat/qtto a version that resolves this vulnerability.Fixed in 5.15.9 - Upgrade
Upgrade
redhat/qtto a version that resolves this vulnerability.Fixed in 6.2.4 - Upgrade
Upgrade
Qtto a version that resolves this vulnerability.Fixed in 5.15.9 - Upgrade
Upgrade
Qtto a version that resolves this vulnerability.Fixed in 6.2.4
Event History
Frequently Asked Questions
What is CVE-2022-25255?
CVE-2022-25255 is a vulnerability in Qt library versions 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX operating systems.
How does CVE-2022-25255 affect Qt?
CVE-2022-25255 allows QProcess in Qt to execute a binary from the current working directory when not found in the PATH.
What is the severity of CVE-2022-25255?
The severity of CVE-2022-25255 is high with a CVSS score of 7.8.
Which versions of Qt are affected by CVE-2022-25255?
Qt versions 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 are affected by CVE-2022-25255.
How can I mitigate CVE-2022-25255?
To mitigate CVE-2022-25255, it is recommended to upgrade to Qt version 5.15.9 or 6.2.4 or later.