{"id":"CVE-2017-10904","aliases":["EUVD-2017-2544","GHSA-872g-v8g9-374r","UBUNTU-CVE-2017-10904"],"status":"published","title":"Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via...","description":"Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01958,"percentile":0.80441,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2017-12-15T14:00:00Z","modified":"2026-10-24T14:05:17Z","affected":[{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qt4-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.8.4+dfsg-0ubuntu18","4:4.8.4+dfsg-0ubuntu19","4:4.8.4+dfsg-0ubuntu20","4:4.8.4+dfsg-0ubuntu21","4:4.8.4+dfsg-0ubuntu22","4:4.8.5+git192-g085f851+dfsg-2ubuntu3","4:4.8.5+git192-g085f851+dfsg-2ubuntu4","4:4.8.5+git192-g085f851+dfsg-2ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qt4-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.8.6+git64-g5dc8b2b+dfsg-3~ubuntu8","4:4.8.7+dfsg-5ubuntu1","4:4.8.7+dfsg-5ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2+dfsg-2ubuntu9","5.5.1+dfsg-6ubuntu4","5.5.1+dfsg-10ubuntu2","5.5.1+dfsg-13ubuntu1","5.5.1+dfsg-13ubuntu2","5.5.1+dfsg-13ubuntu3","5.5.1+dfsg-14ubuntu1","5.5.1+dfsg-14ubuntu2","5.5.1+dfsg-14ubuntu3","5.5.1+dfsg-15ubuntu1","5.5.1+dfsg-16ubuntu1","5.5.1+dfsg-16ubuntu6","5.5.1+dfsg-16ubuntu7","5.5.1+dfsg-16ubuntu7.1","5.5.1+dfsg-16ubuntu7.2","5.5.1+dfsg-16ubuntu7.5","5.5.1+dfsg-16ubuntu7.6","5.5.1+dfsg-16ubuntu7.7","5.5.1+dfsg-16ubuntu7.7+esm1","5.5.1+dfsg-16ubuntu7.7+esm2"]}],"products":[{"vendor":"qt","product":"qt"},{"vendor":"the qt company","product":"qt for android"}],"references":[{"url":"https://jvn.jp/en/jp/JVN67389262/index.html","tags":["third-party-advisory","x_refsource_JVN","x_transferred","Issue Tracking","Third Party Advisory","VDB Entry","report"]},{"url":"https://blog.qt.io/blog/2017/11/22/security-advisory-qt-android/","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10904"},{"url":"https://blog.qt.io/blog/2017/11/22/security-advisory-qt-android"},{"url":"https://github.com/advisories/GHSA-872g-v8g9-374r"},{"url":"https://ubuntu.com/security/CVE-2017-10904","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10904","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-10904","description":"Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.","status":"published","published":"2017-12-15T14:00:00Z","modified":"2024-08-05T17:50:12.619Z","updated_at":"2026-11-02T14:33:13.606903Z"}],"euvd":[{"id":"EUVD-2017-2544","description":"Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.","status":"published","published":"2017-12-15T14:00:00Z","modified":"2024-08-05T17:50:12Z","updated_at":"2026-11-03T02:23:25.281788Z"}],"ghsa":[{"id":"GHSA-872g-v8g9-374r","title":"Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via...","description":"Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.","status":"published","published":"2022-05-14T04:03:16Z","modified":"2025-04-20T03:51:08Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:01:57.945283Z"}],"nvd":[{"id":"CVE-2017-10904","description":"Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.","status":"published","published":"2017-12-16T02:29:07.183Z","modified":"2026-06-17T01:00:53.66Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:04:10.156892Z"}],"osv":[{"id":"CVE-2017-10904","description":"Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.","status":"published","published":"2017-12-16T02:29:07.183Z","modified":"2026-10-24T14:05:17.231243635Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"UBUNTU-CVE-2017-10904","description":"Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.","status":"published","published":"2017-12-16T02:29:00Z","modified":"2026-04-22T11:10:03.494761Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:13.729565Z"}]}}