{"id":"CVE-2022-25255","aliases":["ALSA-2022:7482","ALSA-2022:8022","AZL-50050","DEBIAN-CVE-2022-25255","EUVD-2022-29952","GHSA-fw78-qp2x-5gc7","OESA-2022-1787","OESA-2022-1803","RHSA-2022:7482","RHSA-2022:8022","RLSA-2022:7482","RLSA-2022:8022","SUSE-SU-2022:0841-1","UBUNTU-CVE-2022-25255","openSUSE-SU-2022:0841-1","openSUSE-SU-2024:11879-1","openSUSE-SU-2024:11886-1","openSUSE-SU-2024:11974-1"],"status":"published","title":"In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could...","description":"In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00331,"percentile":0.26482,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-02-16T18:48:35Z","modified":"2026-11-05T12:15:03Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"qt5-devel","fixed_in":["5.15.3-1.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"qt5-rpm-macros","fixed_in":["5.15.3-1.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"qt5-srpm-macros","fixed_in":["5.15.3-1.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"qt5","fixed_in":["5.15.3-1.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"qt5-devel","fixed_in":["5.15.3-1.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"qt5-rpm-macros","fixed_in":["5.15.3-1.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"qt5-srpm-macros","fixed_in":["5.15.3-1.el9"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"qt5-qtbase","fixed_in":["5.12.11-14"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"qt6-base","fixed_in":["6.2.4+dfsg-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qt6-base","fixed_in":["6.2.4+dfsg-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qt6-base","fixed_in":["6.2.4+dfsg-4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"qtbase-opensource-src","fixed_in":["5.15.2+dfsg-15"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qtbase-opensource-src","fixed_in":["5.15.2+dfsg-15"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qtbase-opensource-src","fixed_in":["5.15.2+dfsg-15"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"qtbase-opensource-src-gles","fixed_in":["5.15.4+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qtbase-opensource-src-gles","fixed_in":["5.15.4+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qtbase-opensource-src-gles","fixed_in":["5.15.4+dfsg-2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"qt5-qtbase","fixed_in":["5.11.1-13.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"qt5-qtbase","fixed_in":["5.11.1-13.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"qt5-qtbase","fixed_in":["5.15.2-3.oe2203"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5","fixed_in":["0:5.15.3-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-rpm-macros","fixed_in":["0:5.15.3-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-srpm-macros","fixed_in":["0:5.15.3-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-devel","fixed_in":["0:5.15.3-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qt5","fixed_in":["0:5.15.3-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qt5-rpm-macros","fixed_in":["0:5.15.3-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qt5-srpm-macros","fixed_in":["0:5.15.3-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"qt5-devel","fixed_in":["0:5.15.3-1.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"qt5","fixed_in":["0:5.15.3-1.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"qt5","fixed_in":["0:5.15.3-1.el9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qtbase-opensource-src","fixed_in":["5.12.8+dfsg-0ubuntu2.1+esm3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libqt5-qtbase","fixed_in":["5.15.2+kde294-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"qt6-base","fixed_in":["6.2.3-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"qutebrowser","fixed_in":["2.5.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"qt5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3-1.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"qt5-rpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3-1.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"qt5-srpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3-1.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3-1.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qt5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3-1.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qt5-rpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3-1.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qt5-srpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3-1.el9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.11-14"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.4+dfsg-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.4+dfsg-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.4+dfsg-4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2+dfsg-15"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2+dfsg-15"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2+dfsg-15"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.4+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.4+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.4+dfsg-2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.1-13.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.1-13.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-3.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.3-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-rpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.3-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-srpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.3-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.3-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.3-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qt5-rpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.3-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qt5-srpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.3-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"qt5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.3-1.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.3-1.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"qt5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.3-1.el9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.8+dfsg-0ubuntu2.1+esm3"}]}],"versions":["5.12.4+dfsg-4ubuntu1","5.12.5+dfsg-2","5.12.5+dfsg-8","5.12.5+dfsg-8build1","5.12.5+dfsg-9build1","5.12.8+dfsg-0ubuntu1","5.12.8+dfsg-0ubuntu2.1","5.12.8+dfsg-0ubuntu2.1+esm1","5.12.8+dfsg-0ubuntu2.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.2+dfsg-5ubuntu1","6.2.2+dfsg-6ubuntu1","6.2.2+dfsg-6ubuntu2","6.2.4+dfsg-1ubuntu1","6.2.4+dfsg-2ubuntu1","6.2.4+dfsg-2ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.2+dfsg-18","6.4.2+dfsg-19","6.4.2+dfsg-19build1","6.4.2+dfsg-20","6.4.2+dfsg-21","6.4.2+dfsg-21.1build4","6.4.2+dfsg-21.1build5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.3+dfsg-0ubuntu2","6.8.3+dfsg-0ubuntu3","6.9.2+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.2+dfsg-7","6.10.2+dfsg-14ubuntu2","6.10.2+dfsg-15","6.10.2+dfsg-16","6.11.2+dfsg-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.2+dfsg-1ubuntu1","6.9.2+dfsg-2","6.9.2+dfsg-3ubuntu1","6.9.2+dfsg-3ubuntu2","6.9.2+dfsg-4","6.10.2+dfsg-3","6.10.2+dfsg-6","6.10.2+dfsg-7"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.7-4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libqt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2+kde294-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qt6-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.3-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qutebrowser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.1"}]}]}],"products":[{"vendor":"qt","product":"qt"}],"references":[{"url":"https://codereview.qt-project.org/c/qt/qtbase/+/393113","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix","report"]},{"url":"https://codereview.qt-project.org/c/qt/qtbase/+/394914","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://download.qt.io/official_releases/qt/6.2/qprocess6-2.diff","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://download.qt.io/official_releases/qt/5.15/qprocess5-15.diff","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://codereview.qt-project.org/c/qt/qtbase/+/396020","tags":["x_refsource_MISC","x_transferred","Patch","Release Notes","Vendor Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25255","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-fw78-qp2x-5gc7"},{"url":"https://access.redhat.com/errata/RHSA-2022:7482","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25255","tags":["report"]},{"url":"https://bugzilla.redhat.com/2055505","tags":["report"]},{"url":"https://bugzilla.redhat.com/2061377","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-7482.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8022","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-8022.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-25255","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1787","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1803","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.7_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055505","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2061377","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7482.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25255","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2061352","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8022.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:7482","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:8022","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220841-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1195386","tags":["report"]},{"url":"https://bugzilla.suse.com/1196501","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-25255","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-25255","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8076-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NIPE5FF5VKMSL2BZDJ46HDRCTHGR7IUG/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-25255","description":"In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.","status":"published","published":"2022-02-16T18:48:35Z","modified":"2024-08-03T04:36:06.65Z","updated_at":"2026-11-02T14:34:28.707644Z"}],"euvd":[{"id":"EUVD-2022-29952","description":"In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.","status":"published","published":"2022-02-16T18:48:35Z","modified":"2024-08-03T04:36:06Z","updated_at":"2026-11-03T03:25:47.443246Z"}],"ghsa":[{"id":"GHSA-fw78-qp2x-5gc7","title":"In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could...","description":"In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.","status":"published","published":"2022-02-17T00:00:27Z","modified":"2023-02-03T05:06:17Z","updated_at":"2026-11-02T14:53:52.260774Z"}],"nvd":[{"id":"CVE-2022-25255","description":"In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.","status":"published","published":"2022-02-16T19:15:09.3Z","modified":"2026-06-17T04:33:17.07Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:07:12.155838Z"}],"osv":[{"id":"AZL-50050","title":"CVE-2022-25255 affecting package qt5-qtbase for versions less than 5.12.11-14","description":"In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.","status":"published","published":"2022-02-16T19:15:09Z","modified":"2026-04-21T04:30:05.948971Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"CVE-2022-25255","description":"In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.","status":"published","published":"2022-02-16T19:15:09.3Z","modified":"2026-04-11T22:01:29.840526Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"DEBIAN-CVE-2022-25255","description":"In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.","status":"published","published":"2022-02-16T19:15:09.3Z","modified":"2026-11-03T08:02:46.195246211Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"OESA-2022-1787","title":"qt5-qtbase security update","description":"Qt is a software toolkit for developing applications.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.(CVE-2022-25255)","status":"published","published":"2022-07-30T11:05:03Z","modified":"2026-08-18T01:16:51.833357884Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-1803","title":"qt5-qtbase security update","description":"Qt is a software toolkit for developing applications.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.(CVE-2022-25255)","status":"published","published":"2022-08-05T11:05:04Z","modified":"2026-08-18T01:17:07.31535636Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2022:7482","title":"Red Hat Security Advisory: qt5 security, bug fix, and enhancement update","status":"published","published":"2024-09-16T07:52:42Z","modified":"2026-06-26T12:22:29.662358126Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:8022","title":"Red Hat Security Advisory: qt5 security and bug fix update","status":"published","published":"2024-09-16T07:52:49Z","modified":"2026-06-26T12:22:06.168493716Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2022:7482","title":"Moderate: qt5 security, bug fix, and enhancement update","description":"The Qt5 libraries packages provide Qt 5, version 5 of the Qt cross-platform application framework.\n\nThe following packages have been upgraded to a later upstream version: qt5 (5.15.3). (BZ#2061377)\n\nSecurity Fix(es):\n\n* qt: QProcess could execute a binary from the current working directory when not found in the PATH (CVE-2022-25255)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.","status":"published","published":"2022-11-08T06:20:39Z","modified":"2026-02-05T11:45:05.015489Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2022:8022","title":"Moderate: qt5 security and bug fix update","description":"The Qt5 libraries packages provide Qt 5, version 5 of the Qt cross-platform application framework.\n\nSecurity Fix(es):\n\n* qt: QProcess could execute a binary from the current working directory when not found in the PATH (CVE-2022-25255)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.","status":"published","published":"2022-11-15T06:13:53Z","modified":"2026-02-05T08:30:09.064822Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-25255","description":"In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.","status":"published","published":"2022-02-16T19:15:00Z","modified":"2026-10-17T12:55:57.496256723Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"ALSA-2022:7482","title":"Moderate: qt5 security, bug fix, and enhancement update","description":"The Qt5 libraries packages provide Qt 5, version 5 of the Qt cross-platform application framework.\n\nThe following packages have been upgraded to a later upstream version: qt5 (5.15.3). (BZ#2061377)\n\nSecurity Fix(es):\n\n* qt: QProcess could execute a binary from the current working directory when not found in the PATH (CVE-2022-25255)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-11-08T00:00:00Z","modified":"2026-11-05T12:15:03.914491686Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"ALSA-2022:8022","title":"Moderate: qt5 security and bug fix update","description":"The Qt5 libraries packages provide Qt 5, version 5 of the Qt cross-platform application framework.\n\nSecurity Fix(es):\n\n* qt: QProcess could execute a binary from the current working directory when not found in the PATH (CVE-2022-25255)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-11-15T00:00:00Z","modified":"2026-10-29T11:31:20.134864822Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"openSUSE-SU-2022:0841-1","title":"Security update for libqt5-qtbase","description":"This update for libqt5-qtbase fixes the following issues:\n\n- CVE-2022-23853, CVE-2022-25255: Avoid unintentionally using binaries from CWD\n  (bsc#1195386, bsc#1196501).\n","status":"published","published":"2022-03-15T10:32:09Z","modified":"2025-05-07T18:13:50.325273Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11879-1","title":"libQt5Bootstrap-devel-static-32bit-5.15.2+kde294-4.1 on GA media","description":"These are all security issues fixed in the libQt5Bootstrap-devel-static-32bit-5.15.2+kde294-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:28:37.08698Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:11886-1","title":"libQt6Concurrent6-6.2.3-2.1 on GA media","description":"These are all security issues fixed in the libQt6Concurrent6-6.2.3-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:51:41.391133Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:11974-1","title":"qutebrowser-2.5.0-1.1 on GA media","description":"These are all security issues fixed in the qutebrowser-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:01.611836Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:0841-1","title":"Security update for libqt5-qtbase","description":"This update for libqt5-qtbase fixes the following issues:\n\n- CVE-2022-23853, CVE-2022-25255: Avoid unintentionally using binaries from CWD\n  (bsc#1195386, bsc#1196501).\n","status":"published","published":"2022-03-15T10:32:44Z","modified":"2026-02-04T03:00:41.674138Z","updated_at":"2026-11-02T15:53:50.066806Z"}]}}