HighFix available
qtbase-opensource-src, qtbase-opensource-src-gles — security advisory
An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.
- Products
- qtbase-opensource-src, qtbase-opensource-src-gles
- Affected versions
- Not specified
- Fixed versions
- 5.12.5+dfsg-8, 5.14.2+dfsg-3
- CVEs
- CVE-2020-24742
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 11:07 UTC · Revision 1
Source evidence
An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.
osv:DEBIAN-CVE-2020-24742
qtbase-opensource-src
Fixed versions: 5.12.5+dfsg-8
qtbase-opensource-src
Fixed versions: 5.12.5+dfsg-8
qtbase-opensource-src
Fixed versions: 5.12.5+dfsg-8
qtbase-opensource-src-gles
Fixed versions: 5.14.2+dfsg-3
qtbase-opensource-src-gles
Fixed versions: 5.14.2+dfsg-3
qtbase-opensource-src-gles
Fixed versions: 5.14.2+dfsg-3
Complete source record
{
"id": "4c0eca6e1ee008eb0856ddabd17ca32ce1b9a153acbe74999726e80ef64a0a39",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2020-24742",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2020-24742",
"summary": "An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.",
"evidence": "osv:DEBIAN-CVE-2020-24742",
"products": [
{
"name": {
"value": "qtbase-opensource-src",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.12.5+dfsg-8",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "qtbase-opensource-src",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.12.5+dfsg-8",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "qtbase-opensource-src",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.12.5+dfsg-8",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "qtbase-opensource-src-gles",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.14.2+dfsg-3",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "qtbase-opensource-src-gles",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.14.2+dfsg-3",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "qtbase-opensource-src-gles",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.14.2+dfsg-3",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2020-24742",
"aliases": [
"DEBIAN-CVE-2020-24742"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.12.5+dfsg-8"
}
]
}
],
"package": {
"name": "qtbase-opensource-src",
"purl": "pkg:deb/debian/qtbase-opensource-src?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-24742.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.12.5+dfsg-8"
}
]
}
],
"package": {
"name": "qtbase-opensource-src",
"purl": "pkg:deb/debian/qtbase-opensource-src?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-24742.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.12.5+dfsg-8"
}
]
}
],
"package": {
"name": "qtbase-opensource-src",
"purl": "pkg:deb/debian/qtbase-opensource-src?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-24742.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.14.2+dfsg-3"
}
]
}
],
"package": {
"name": "qtbase-opensource-src-gles",
"purl": "pkg:deb/debian/qtbase-opensource-src-gles?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-24742.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.14.2+dfsg-3"
}
]
}
],
"package": {
"name": "qtbase-opensource-src-gles",
"purl": "pkg:deb/debian/qtbase-opensource-src-gles?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-24742.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.14.2+dfsg-3"
}
]
}
],
"package": {
"name": "qtbase-opensource-src-gles",
"purl": "pkg:deb/debian/qtbase-opensource-src-gles?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-24742.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-09T09:47:27.931098580Z",
"provider": "osv",
"upstream": [
"CVE-2020-24742"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2020-24742"
]
},
"related_cves": [
{
"value": "CVE-2020-24742",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 111543,
"published_at": "2021-08-09T22:15:08.607+00:00"
}