[<prev] [next>] [day] [month] [year] [list]
Message-ID: <4121113.n0WVUT9hOZ@tjmaciei-mobl1>
Date: Wed, 29 Jan 2020 17:17:49 -0800
From: Thiago Macieira <thiago.macieira@...el.com>
To: <oss-security@...ts.openwall.com>
Subject: New Qt vulnerabilities
The Qt security team was made aware of two issues affecting the currently-
released versions of Qt that could lead to loading of untrusted plugins, which
can execute code immediately upon loading. We have assigned two IDs for them.
The patches fixing those issues are linked to below.
Issue 1) CVE-2020-0569
Score: 7.3 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
* Vendor: Qt Project
* Product: Qt
* Versions affected: 5.0.0 to 5.13.2
* Versions fixed: 5.14.0 (already released), 5.12.7, 5.9.10 (future)
* Issue: local attack, loading and execution of untrusted code
* Scope: class QPluginLoader (qtbase/src/corelib/plugin/qpluginloader.cpp)
* Description:
QPluginLoader in Qt versions 5.0.0 through 5.13.2 would search for certain
plugins first on the current working directory of the application, which
allows an attacker that can place files in the file system and influence the
working directory of Qt-based applications to load and execute malicious code.
This issue was verified on macOS and Linux and probably affects all other Unix
operating systems. This issue does not affect Windows.
Patches:
- 5.6.0 through 5.13.2: https://code.qt.io/cgit/qt/qtbase.git/commit/?
id=bf131e8d2181b3404f5293546ed390999f760404
- 5.0.0 through 5.5.1: https://code.qt.io/cgit/qt/qtbase.git/commit/?
id=5c4234ed958130d655df8197129806f687d4df0d
Issue 2) CVE-2020-0570
Score: 7.3 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
* Vendor: Qt Project
* Product: Qt
* Versions affected: 5.12.0 through 5.14.0
* Versions fixed: 5.14.1 (released), 5.12.7, 5.9.10 (future)
* Issue: local attack, loading and execution of untrusted code
* Scope: class QLibrary (qtbase/src/corelib/plugin)
* Reference: https://bugreports.qt.io/browse/QTBUG-81272
* Description:
QLibrary in Qt versions 5.12.0 through 5.14.0, on certain x86 machines, would
search for certain libraries and plugins relative to current working directory
of the application, which allows an attacker that can place files in the file
system and influence the working directory of Qt-based applications to load
and execute malicious code. This issue was verified on Linux and probably
affects all Unix operating systems, other than macOS (Darwin). This issue does
not affect Windows.
Patch: https://code.qt.io/cgit/qt/qtbase.git/commit/?
id=e6f1fde24f77f63fb16b2df239f82a89d2bf05dd
--
Thiago Macieira - thiago.macieira (AT) intel.com
Software Architect - Intel System Software Products
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
