Unscored CVE-2017-10904 EUVD-2017-2544GHSA-872g-v8g9-374r

Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.

Published Dec 15, 2017 · Updated Aug 5, 2024 · Assigned by jpcert

Vendor: The Qt Company Product: Qt for Android Package: qt4-x11 Package: qtbase-opensource-src Platform: Android Ecosystem: Ubuntu

Description

Affected products

Vendor	Product	Affected	Fixed
The Qt Company	Qt for Android	prior to 5.9.0	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	qt4-x11	No fix yet	—
Ubuntu 14.04 LTS	qt4-x11	No fix yet	—

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 16.04 LTS	qtbase-opensource-src	No fix yet	—

References

JVN#67389262 third-party-advisory
https://blog.qt.io/blog/2017/11/22/security-advisory-qt-android/