{"id":"CVE-2020-24741","aliases":["EUVD-2020-17452","GHSA-j6vg-fh5g-5g73","MGASA-2021-0510","SUSE-SU-2021:3268-1","SUSE-SU-2021:3269-1","SUSE-SU-2023:2816-1","UBUNTU-CVE-2020-24741"],"status":"rejected","title":"An issue has been fixed in Qt versions 5.14.1 and 5.12.7 where QLibrary attempts to load plugins...","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-0570. Reason: This candidate is a duplicate of CVE-2020-0570. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2020-0570 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-08-09T21:18:25Z","modified":"2026-04-16T04:43:39Z","fixes":[{"ecosystem":"Mageia:8","package":"qt4","fixed_in":["4.8.7-35.2.mga8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"libqt5-qtbase","fixed_in":["5.6.1-17.21.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"libqt5-qtbase","fixed_in":["5.9.4-8.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"libqt5-qtbase","fixed_in":["5.9.4-8.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"libqt5-qtbase","fixed_in":["5.9.4-8.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"libqt5-qtbase","fixed_in":["5.9.4-8.29.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:8","package":"qt4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.7-35.2.mga8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-17.21.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.4-8.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.4-8.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.4-8.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.4-8.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2-6.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2-6.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2-6.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2-6.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2-6.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2-6.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2-6.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2-6.33.1"}]}],"bundled":2}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-24741"},{"url":"https://bugreports.qt.io/browse/QTBUG-81272","tags":["report"]},{"url":"https://github.com/advisories/GHSA-j6vg-fh5g-5g73"},{"url":"https://advisories.mageia.org/MGASA-2021-0510.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29602","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/SEVLZYF3XAD2Q2HTNQP3SIFCQPSXYHAS/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213268-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1178600","tags":["report"]},{"url":"https://bugzilla.suse.com/1189408","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24741","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213269-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232816-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1211798","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32763","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-24741","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-24741","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-24741","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-0570. Reason: This candidate is a duplicate of CVE-2020-0570. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2020-0570 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2021-08-09T21:18:25Z","modified":"2021-08-21T16:54:53Z","updated_at":"2026-11-02T14:35:54.468882Z"}],"euvd":[{"id":"EUVD-2020-17452","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-0570. Reason: This candidate is a duplicate of CVE-2020-0570. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2020-0570 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"published","published":"2021-08-09T21:18:25Z","modified":"2021-08-21T16:54:53Z","updated_at":"2026-11-03T03:51:14.673364Z"}],"ghsa":[{"id":"GHSA-j6vg-fh5g-5g73","title":"An issue has been fixed in Qt versions 5.14.1 and 5.12.7 where QLibrary attempts to load plugins...","description":"An issue has been fixed in Qt versions 5.14.1 and 5.12.7 where QLibrary attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.","status":"published","published":"2022-05-24T19:10:38Z","modified":"2023-01-30T05:01:20Z","updated_at":"2026-11-02T14:46:23.547617Z"}],"nvd":[{"id":"CVE-2020-24741","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-0570. Reason: This candidate is a duplicate of CVE-2020-0570. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2020-0570 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2021-08-09T22:15:08.563Z","modified":"2023-11-07T03:20:10.17Z","updated_at":"2026-11-02T14:06:44.292752Z"}],"osv":[{"id":"UBUNTU-CVE-2020-24741","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-0570. Reason: This candidate is a duplicate of CVE-2020-0570. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2020-0570 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.","status":"withdrawn","published":"2021-08-09T22:15:00Z","modified":"2025-08-01T04:52:28Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"MGASA-2021-0510","title":"Updated qt4 packages fix security vulnerability","description":"CVE-2020-24741, Do not attempt to load a library relative to $PWD\n","status":"published","published":"2021-11-18T21:50:59Z","modified":"2026-04-16T04:43:39.984427914Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"SUSE-SU-2021:3268-1","title":"Security update for libqt5-qtbase","description":"This update for libqt5-qtbase fixes the following issues:\n\n- CVE-2020-24741: Fixed a bug that allowed QLibrary to load libraries relative to CWD which could result in arbitrary code execution. (bsc#1189408)\n","status":"published","published":"2021-09-30T13:54:08Z","modified":"2026-02-04T03:31:52.630414Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3269-1","title":"Security update for libqt5-qtbase","description":"This update for libqt5-qtbase fixes the following issues:\n\n- CVE-2020-24741: Fixed a bug that allowed QLibrary to load libraries relative to CWD which could result in arbitrary code execution. (bsc#1189408)\n","status":"published","published":"2021-09-30T13:54:43Z","modified":"2026-02-04T02:56:19.514085Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2023:2816-1","title":"Security update for libqt5-qtbase","description":"This update for libqt5-qtbase fixes the following issues:\n\n  - CVE-2020-24741: Fixed a bug that allow QLibrary to load libraries relative to CWD which could result in arbitrary code execution (bsc#1189408).\n  - CVE-2023-32763: Fixed buffer overflow in QTextLayout (bsc#1211798).\n\n","status":"published","published":"2023-07-13T07:25:19Z","modified":"2025-05-02T04:30:37.913499Z","updated_at":"2026-11-02T15:53:53.019382Z"}]}}