Untrusted search path in Qt - CVE-2020-0569

Vulnerability identifier: #VU24782

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-0569

CWE-ID: CWE-426

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to QPluginLoader in Qt searches for certain plugins first on the current working directory of the application. A local user can place files in the file system and influence the working directory of Qt-based applications to load and execute malicious code. 

Note, this vulnerability does not affect Windows systems.

Qt
Gentoo Linux
Debian Linux
Fedora
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Opensuse
qtbase-opensource-src (Ubuntu package)
qt5-qtbase (Red Hat package)
qt5-qtbase
qtbase-opensource-src (Debian package)

Install updates from vendor's website.

Qt - update to 5.14.0
qtbase-opensource-src (Ubuntu package) - addressed in versions 5.5.1+dfsg-16ubuntu7.7, 5.9.5+dfsg-0ubuntu2.5, 5.12.4+dfsg-4ubuntu1.1
qt5-qtbase (Red Hat package) - update to 5.9.7-4.el7
qt5-qtbase - update to 5.6.1-6.el6
qtbase-opensource-src (Debian package) - addressed in versions 5.7.1+dfsg-3+deb9u2, 5.11.3+dfsg1-1+deb10u3

• http://seclists.org/oss-sec/2020/q1/43

• Privilege escalation in Qt
• Ubuntu update for Qt
• OpenSUSE Linux update for libqt5-qtbase
• Gentoo update for QtCore
• Red Hat Enterprise Linux 7 update for qt5-qtbase
• Debian update for qtbase-opensource-src
• Fedora EPEL 6 update for qt5-qtbase