Description
Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | qtbase-opensource-src-gles | No fix yet | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | qt5-qtbase +10 | 5.9.2-3.amzn2.0.12 | ALAS2-2023-2252 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | qt5-qtsvg | 5.12.11-3 | — |
Advisories 4
- ICSA-23-222-04 ​Siemens Software Center CISA ICS & IT advisories · May 6, 2025
- WID-SEC-2023-2403 QT: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Sep 20, 2023
- ALAS2-2023-2252 Moderate: qt5-qtbase security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 20, 2023
- SSA-188491 SSA-188491: DLL Hijacking Vulnerabilities in Siemens Software Center Siemens ProductCERT · Aug 8, 2023
References
- https://codereview.qt-project.org/c/qt/qtbase/+/396440
- https://codereview.qt-project.org/c/qt/qtbase/+/396689
- https://download.qt.io/official_releases/qt/6.2/CVE-2022-25643-6.2.diff
- https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/396690
- https://download.qt.io/official_releases/qt/5.15/CVE-2022-25643-5.15.diff