{"id":"CVE-2017-10905","aliases":["EUVD-2017-2545","GHSA-v2wg-hv5c-mp2x","UBUNTU-CVE-2017-10905"],"status":"published","title":"A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to...","description":"A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00576,"percentile":0.47772,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2017-12-15T14:00:00Z","modified":"2026-10-24T14:08:59Z","affected":[{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qt4-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.8.4+dfsg-0ubuntu18","4:4.8.4+dfsg-0ubuntu19","4:4.8.4+dfsg-0ubuntu20","4:4.8.4+dfsg-0ubuntu21","4:4.8.4+dfsg-0ubuntu22","4:4.8.5+git192-g085f851+dfsg-2ubuntu3","4:4.8.5+git192-g085f851+dfsg-2ubuntu4","4:4.8.5+git192-g085f851+dfsg-2ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qt4-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.8.6+git64-g5dc8b2b+dfsg-3~ubuntu8","4:4.8.7+dfsg-5ubuntu1","4:4.8.7+dfsg-5ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2+dfsg-2ubuntu9","5.5.1+dfsg-6ubuntu4","5.5.1+dfsg-10ubuntu2","5.5.1+dfsg-13ubuntu1","5.5.1+dfsg-13ubuntu2","5.5.1+dfsg-13ubuntu3","5.5.1+dfsg-14ubuntu1","5.5.1+dfsg-14ubuntu2","5.5.1+dfsg-14ubuntu3","5.5.1+dfsg-15ubuntu1","5.5.1+dfsg-16ubuntu1","5.5.1+dfsg-16ubuntu6","5.5.1+dfsg-16ubuntu7","5.5.1+dfsg-16ubuntu7.1","5.5.1+dfsg-16ubuntu7.2","5.5.1+dfsg-16ubuntu7.5","5.5.1+dfsg-16ubuntu7.6","5.5.1+dfsg-16ubuntu7.7","5.5.1+dfsg-16ubuntu7.7+esm1","5.5.1+dfsg-16ubuntu7.7+esm2"]}],"products":[{"vendor":"qt","product":"qt"},{"vendor":"the qt company","product":"qt for android"}],"references":[{"url":"https://jvn.jp/en/jp/JVN27342829/index.html","tags":["third-party-advisory","x_refsource_JVN","x_transferred","Issue Tracking","Third Party Advisory","VDB Entry","report"]},{"url":"https://blog.qt.io/blog/2017/11/22/security-advisory-qt-android/","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10905"},{"url":"https://blog.qt.io/blog/2017/11/22/security-advisory-qt-android"},{"url":"https://github.com/advisories/GHSA-v2wg-hv5c-mp2x"},{"url":"https://ubuntu.com/security/CVE-2017-10905","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10905","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-10905","description":"A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors.","status":"published","published":"2017-12-15T14:00:00Z","modified":"2024-08-05T17:50:12.508Z","updated_at":"2026-11-02T14:33:12.942409Z"}],"euvd":[{"id":"EUVD-2017-2545","description":"A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors.","status":"published","published":"2017-12-15T14:00:00Z","modified":"2024-08-05T17:50:12Z","updated_at":"2026-11-03T02:23:25.281788Z"}],"ghsa":[{"id":"GHSA-v2wg-hv5c-mp2x","title":"A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to...","description":"A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors.","status":"published","published":"2022-05-13T01:42:00Z","modified":"2025-04-20T03:51:08Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:01:57.295459Z"}],"nvd":[{"id":"CVE-2017-10905","description":"A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors.","status":"published","published":"2017-12-16T02:29:07.23Z","modified":"2026-06-17T01:00:53.77Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:10.156892Z"}],"osv":[{"id":"CVE-2017-10905","description":"A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors.","status":"published","published":"2017-12-16T02:29:07.23Z","modified":"2026-10-24T14:08:59.397191667Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"UBUNTU-CVE-2017-10905","description":"A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors.","status":"published","published":"2017-12-16T02:29:00Z","modified":"2026-04-22T11:09:19.342853Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:13.729565Z"}]}}