CVE-2025-14575
Fixed in a distro release EPSS <1%CVSS 1.8
An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.
Products: qt
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | libqt4 | 4.8.7-8.25.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | libqt4-devel-doc | 4.8.7-8.25.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | libqt4-sql-plugins | 4.8.7-8.25.1 |
| Ubuntu 16.04 LTS | qtbase-opensource-src-gles | no fix |
| Ubuntu 20.04 LTS | qtbase-opensource-src-gles | no fix |
| Ubuntu 22.04 LTS | qt6-base | no fix |
| Ubuntu 22.04 LTS | qtbase-opensource-src-gles | no fix |
| Ubuntu 24.04 LTS | qt6-base | no fix |
| Ubuntu 24.04 LTS | qtbase-opensource-src-gles | no fix |
| Ubuntu 25.10 | qt6-base | no fix |
| Ubuntu 25.10 | qtbase-opensource-src | no fix |
| Ubuntu 25.10 | qtbase-opensource-src-gles | no fix |
| Ubuntu 26.04 LTS | qt6-base | no fix |
| Ubuntu 26.04 LTS | qtbase-opensource-src | no fix |
| Ubuntu 26.04 LTS | qtbase-opensource-src-gles | no fix |
| Ubuntu 26.10 | qt6-base | no fix |
| Ubuntu 26.10 | qtbase-opensource-src | no fix |
| Ubuntu 26.10 | qtbase-opensource-src-gles | no fix |
| Ubuntu Pro 16.04 LTS | qtbase-opensource-src | no fix |
| Ubuntu Pro 18.04 LTS | qtbase-opensource-src | no fix |
| Ubuntu Pro 20.04 LTS | qtbase-opensource-src | no fix |
| Ubuntu Pro 22.04 LTS | qtbase-opensource-src | no fix |
| Ubuntu Pro 24.04 LTS | qtbase-opensource-src | no fix |