CVE-2010-3374 Qt Creator before 2.0.1 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
MediumCVSS 6.9
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Qt Creator before 2.0.1 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nokia qt creator | <= 2.0.0 | No fix listed |
| nokia qt creator | = 0.9.1-beta | No fix listed |
| nokia qt creator | = 0.9.2-rc1 | No fix listed |
| nokia qt creator | = 1.0.0 | No fix listed |
| nokia qt creator | = 1.1.0 | No fix listed |
| nokia qt creator | = 1.1.0-rc1 | No fix listed |
| nokia qt creator | = 1.2.0 | No fix listed |
| nokia qt creator | = 1.2.90 | No fix listed |
| nokia qt creator | = 1.3.0 | No fix listed |
| nokia qt creator | = 1.3.0-beta | No fix listed |
| nokia qt creator | = 1.3.0-rc1 | No fix listed |
| nokia qt creator | = 1.3.1 | No fix listed |
| nokia qt creator | = 2.0.0-alpha | No fix listed |
| nokia qt creator | = 2.0.0-beta | No fix listed |
| nokia qt creator | = 2.0.0-rc1 | No fix listed |
| debian/qtcreator(Debian:12) | < 1.3.1-3 | 1.3.1-3 |
| debian/qtcreator(Debian:13) | < 1.3.1-3 | 1.3.1-3 |
| debian/qtcreator(Debian:14) | < 1.3.1-3 | 1.3.1-3 |
References
- qt.nokia.com patch vendor-advisory
- MDVSA-2010:193 vendor-advisory
- www.qt.gitorious.org patch
- 43672 vdb-entry
- ADV-2010-2559 vdb-entry vendor-advisory
- ADV-2010-2560 vdb-entry vendor-advisory
- Debian Security Tracker CVE-2010-3374 vendor-advisory
- bugs.debian.org issue-tracking