« Volver al listado

CVE-2010-3374

Estado: ModificadaMedia (6.9)—

Qt Creator before 2.0.1 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Nokia — QT Creator

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-3374",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.9,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-10-04T21:00:04.297",
  "references": [
    {
      "url": "http://qt.nokia.com/about/news/security-announcement-qt-creator-2.0.0-for-desktop-platforms",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:193",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.qt.gitorious.org/qt-creator/qt-creator/commit/3c00715c8e90c57953ec4a8716110f6954e524e4",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/43672",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/2559",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/2560",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://qt.nokia.com/about/news/security-announcement-qt-creator-2.0.0-for-desktop-platforms",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:193",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.qt.gitorious.org/qt-creator/qt-creator/commit/3c00715c8e90c57953ec4a8716110f6954e524e4",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/43672",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/2559",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/2560",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Qt Creator before 2.0.1 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory."
    },
    {
      "lang": "es",
      "value": "Qt Creator en versiones anteriores a la v2.0.1 coloca un nombre de directorio de longitud cero en el LD_LIBRARY_PATH, lo que permite a usuarios locales escalar privilegios a través de un librería compartida maliciosa en el directorio de trabajo actual."
    }
  ],
  "lastModified": "2026-06-16T23:22:39.883",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nokia:qt_creator:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6783CAE-B776-40C5-B2E9-A39C19FD5691",
              "versionEndIncluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nokia:qt_creator:0.9.1:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13CCFF9E-DA2B-4156-B51F-E3BF0BAADD30"
            },
            {
              "criteria": "cpe:2.3:a:nokia:qt_creator:0.9.2:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "26CF43D1-313D-42D7-8797-8F91335148F4"
            },
            {
              "criteria": "cpe:2.3:a:nokia:qt_creator:1.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70477134-5600-47BC-B4D1-841E1E40E7D5"
            },
            {
              "criteria": "cpe:2.3:a:nokia:qt_creator:1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8B60E3E-88DC-460E-9174-DF1B9CA89AD5"
            },
            {
              "criteria": "cpe:2.3:a:nokia:qt_creator:1.1.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B698BFCD-F356-4272-861B-495E2B77032E"
            },
            {
              "criteria": "cpe:2.3:a:nokia:qt_creator:1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6E44114-5453-4E1C-9252-E646D88DA04B"
            },
            {
              "criteria": "cpe:2.3:a:nokia:qt_creator:1.2.90:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE84F5F8-BF9D-46E0-A78A-EA32006FADF8"
            },
            {
              "criteria": "cpe:2.3:a:nokia:qt_creator:1.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21E07663-1337-42D5-8A75-36CF029A0D0D"
            },
            {
              "criteria": "cpe:2.3:a:nokia:qt_creator:1.3.0:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA658A38-2788-4686-A68F-8DC8D96FD4C4"
            },
            {
              "criteria": "cpe:2.3:a:nokia:qt_creator:1.3.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6CE168CE-DE16-4851-ACA2-63912F7BB73E"
            },
            {
              "criteria": "cpe:2.3:a:nokia:qt_creator:1.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1E0BA93-5A34-4B12-88EA-61448C734430"
            },
            {
              "criteria": "cpe:2.3:a:nokia:qt_creator:2.0.0:alpha:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1362D084-E39D-4744-B6B3-5C76A536E170"
            },
            {
              "criteria": "cpe:2.3:a:nokia:qt_creator:2.0.0:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34364F85-A426-44EB-9E6A-61471CBA234C"
            },
            {
              "criteria": "cpe:2.3:a:nokia:qt_creator:2.0.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7EFEEF32-72D5-4F92-B77D-D2225B5E555F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "Per: http://qt.nokia.com/about/news/security-announcement-qt-creator-2.0.0-for-desktop-platforms\r\n\r\n'The issue does not affect Windows or Mac OS X.'",
  "sourceIdentifier": "cve@mitre.org"
}