Qt for Android vulnerable to OS command injection


Qt for Android provided by The Qt Company contains an OS command injection vulnerability (CWE-78).

Satoru Nagaoka of Cyber Defense Institute, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 7.5 (High) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
CVSS V2 Severity:
Base Metrics 5.1 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: High
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: Partial
Affected Products

The Qt Company
  • Qt for Android prior to 5.9.0


A remote attacker may execute an arbitrary OS command.

[Update the Software]
Update to the latest version of software according to the information provided by the developer.

[Apply the Patch]
Patches have been released for Qt for Android 5.7 and 5.8. For more information, refer to the information provided by the developer.
Vendor Information

The Qt Company
CWE (What is CWE?)

  1. OS Command Injection(CWE-78) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2017-10904

  1. JVN : JVN#67389262
  2. National Vulnerability Database (NVD) : CVE-2017-10904
Revision History

  • [2017/12/11]
      Web page was published
  • [2018/03/14]
      References : Content was added