Critical
Security advisory
Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-10904
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:03 UTC · Revision 1
Source evidence
Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
osv:CVE-2017-10904
Complete source record
{
"id": "1ed1b63968de6d66a29a5bb70f4214440b0c7a3ea7104adf36f7404c65e94c9d",
"url": "https://osv.dev/vulnerability/CVE-2017-10904",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-10904",
"summary": "Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.",
"evidence": "osv:CVE-2017-10904",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2017-10904",
"aliases": [
"CVE-2017-10904"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/qt/qt5",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "5bb74ad51f3a976b261c3072d3b49fd9d4c84d0d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:qt:qt:*:*:*:*:*:android:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "5.9.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v5.9.0-rc1",
"v5.9.0-beta4",
"v5.9.0-beta3",
"v5.9.0-beta2",
"v5.9.0-beta1",
"v5.9.0-alpha1",
"v5.0.0-beta1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-10904.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/qt/qtbase",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "f6b36eaafec24b4c67efff621d380a4ca4257d0b"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:qt:qt:*:*:*:*:*:android:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "5.9.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v5.9.0-rc1",
"v5.9.0-beta4",
"v5.9.0-beta3",
"v5.9.0-beta2",
"v5.9.0-beta1",
"v5.9.0-alpha1",
"v5.0.0-beta2",
"v5.0.0-beta1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-10904.json",
"vanir_signatures": [
{
"id": "CVE-2017-10904-2c6fffb2",
"digest": {
"length": 2630,
"function_hash": "164352870239466284880525203474079562082"
},
"source": "https://github.com/qt/qtbase/commit/f6b36eaafec24b4c67efff621d380a4ca4257d0b",
"target": {
"file": "src/widgets/itemviews/qheaderview.cpp",
"function": "QHeaderViewPrivate::read"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-10904-3c44bcf1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"164074333214652703344207342332719907309",
"132579726673860302426051946963971335183",
"8461509609109902108736346206679050087",
"313808976597623905058695953159288432089",
"151413344751434080756681595462594734904",
"58473402307005855852222042282860790836"
]
},
"source": "https://github.com/qt/qtbase/commit/f6b36eaafec24b4c67efff621d380a4ca4257d0b",
"target": {
"file": "src/widgets/itemviews/qheaderview.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-10904-7c6eb266",
"digest": {
"threshold": 0.9,
"line_hashes": [
"76542030488451093116205964448917534261",
"330540106202239942306734099365755131535",
"6476227822993667084215093913601677116",
"120361044892460261233976746848401549366",
"254638331563350843347710057579032493473",
"28401838328222708884847710550912996550",
"82845077507913743721139799057307378519",
"218797872561187179798393419369950502769"
]
},
"source": "https://github.com/qt/qtbase/commit/f6b36eaafec24b4c67efff621d380a4ca4257d0b",
"target": {
"file": "tests/auto/widgets/itemviews/qheaderview/tst_qheaderview.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-10904-d1cfa2dc",
"digest": {
"length": 793,
"function_hash": "90769596104713334155070960973252800177"
},
"source": "https://github.com/qt/qtbase/commit/f6b36eaafec24b4c67efff621d380a4ca4257d0b",
"target": {
"file": "tests/auto/widgets/itemviews/qheaderview/tst_qheaderview.cpp",
"function": "tst_QHeaderView::restoreToMoreColumns"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:05:17Z"
}
}
],
"modified": "2026-10-24T14:05:17.231243635Z",
"provider": "osv",
"references": [
"https://blog.qt.io/blog/2017/11/22/security-advisory-qt-android/",
"https://jvn.jp/en/jp/JVN67389262/index.html"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2017-10904",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442928,
"published_at": "2017-12-16T02:29:07.183+00:00"
}