{"id":"CVE-2021-38593","aliases":["ALSA-2022:1796","AZL-34211","AZL-6838","EUVD-2021-25035","GHSA-qfcf-2jfw-4cm8","MGASA-2021-0493","OESA-2022-2059","OESA-2022-2060","RHSA-2022:1796","RLSA-2022:1796","UBUNTU-CVE-2021-38593","USN-5081-1"],"status":"published","title":"Qt 5.0.0 through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from...","description":"Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03002,"percentile":0.87484,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2021-08-12T00:00:00Z","modified":"2026-11-04T07:07:02Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"qt5-qtbase","fixed_in":["5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"qt5-qtbase-common","fixed_in":["5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"qt5-qtbase-devel","fixed_in":["5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"qt5-qtbase-examples","fixed_in":["5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"qt5-qtbase-gui","fixed_in":["5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"qt5-qtbase-mysql","fixed_in":["5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"qt5-qtbase-odbc","fixed_in":["5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"qt5-qtbase-postgresql","fixed_in":["5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"qt5-qtbase-private-devel","fixed_in":["5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"qt5-qtbase-static","fixed_in":["5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"qt5-qtbase","fixed_in":["5.12.11-11"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"qt5-qtsvg","fixed_in":["5.12.11-3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"qt5-qtbase","fixed_in":["5.11.1-13.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"qt5-qtbase","fixed_in":["5.15.2-3.oe2203"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-common","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-debuginfo","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-debugsource","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-devel","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-devel-debuginfo","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-examples","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-examples-debuginfo","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-gui","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-gui-debuginfo","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-mysql","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-mysql-debuginfo","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-odbc","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-odbc-debuginfo","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-postgresql","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-postgresql-debuginfo","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-private-devel","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-tests-debuginfo","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-debuginfo","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-debugsource","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-devel-debuginfo","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-examples-debuginfo","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-gui-debuginfo","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-mysql-debuginfo","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-odbc-debuginfo","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-postgresql-debuginfo","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-static","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-tests-debuginfo","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"qt5-qtbase","fixed_in":["0:5.15.2-4.el8"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"qtbase-opensource-src","fixed_in":["5.9.5+dfsg-0ubuntu2.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"qtbase-opensource-src","fixed_in":["5.12.8+dfsg-0ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"qt5-qtbase-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"qt5-qtbase-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"qt5-qtbase-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"qt5-qtbase-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"qt5-qtbase-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"qt5-qtbase-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"qt5-qtbase-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"qt5-qtbase-private-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"qt5-qtbase-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.11-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"qt5-qtsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.11-3"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"qtbase5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-4.4.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.11.1-13.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.2-3.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-examples-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-gui-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-odbc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-private-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"qt5-qtbase-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-examples-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-gui-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-odbc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"qt5-qtbase-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"qt5-qtbase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.15.2-4.el8"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2+dfsg-2ubuntu9","5.5.1+dfsg-6ubuntu1","5.5.1+dfsg-10ubuntu1","5.5.1+dfsg-13ubuntu1","5.5.1+dfsg-13ubuntu2","5.5.1+dfsg-13ubuntu3","5.5.1+dfsg-14ubuntu1","5.5.1+dfsg-14ubuntu2","5.5.1+dfsg-14ubuntu3","5.5.1+dfsg-15ubuntu1","5.5.1+dfsg-16ubuntu1","5.5.1+dfsg-16ubuntu4","5.5.1+dfsg-16ubuntu5","5.5.1+dfsg-16ubuntu6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.5+dfsg-0ubuntu2.6"}]}],"versions":["5.9.1+dfsg-10ubuntu1","5.9.1+dfsg-10ubuntu2","5.9.2+dfsg-4ubuntu6","5.9.3+dfsg-0ubuntu1","5.9.3+dfsg-0ubuntu3","5.9.3+dfsg-0ubuntu4","5.9.4+dfsg-0ubuntu3","5.9.4+dfsg-0ubuntu4","5.9.5+dfsg-0ubuntu1","5.9.5+dfsg-0ubuntu2","5.9.5+dfsg-0ubuntu2.1","5.9.5+dfsg-0ubuntu2.3","5.9.5+dfsg-0ubuntu2.4","5.9.5+dfsg-0ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.8+dfsg-0ubuntu2.1"}]}],"versions":["5.12.4+dfsg-4ubuntu1","5.12.5+dfsg-2","5.12.5+dfsg-8","5.12.5+dfsg-8build1","5.12.5+dfsg-9build1","5.12.8+dfsg-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.12.4+dfsg-1build1","5.12.5+dfsg-1","5.12.5+dfsg-2","5.12.8+dfsg-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.2+dfsg-4","5.15.2+dfsg-5","5.15.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.10+dfsg-2","5.15.10+dfsg-3","5.15.12+dfsg-1","5.15.12+dfsg-1ubuntu1","5.15.12+dfsg-1ubuntu2","5.15.13+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-2","5.15.17+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.18+dfsg-1","5.15.19+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qtbase-opensource-src-gles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.17+dfsg-1","5.15.17+dfsg-2","5.15.18+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qtbase-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.5+dfsg-0ubuntu2.6"}]}],"versions":["5.9.1+dfsg-10ubuntu1","5.9.1+dfsg-10ubuntu2","5.9.2+dfsg-4ubuntu6","5.9.3+dfsg-0ubuntu1","5.9.3+dfsg-0ubuntu3","5.9.3+dfsg-0ubuntu4","5.9.4+dfsg-0ubuntu3","5.9.4+dfsg-0ubuntu4","5.9.5+dfsg-0ubuntu1","5.9.5+dfsg-0ubuntu2","5.9.5+dfsg-0ubuntu2.1","5.9.5+dfsg-0ubuntu2.3","5.9.5+dfsg-0ubuntu2.4","5.9.5+dfsg-0ubuntu2.5"],"bundled":2}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"qt","product":"qt"}],"references":[{"url":"https://github.com/qt/qtbase/commit/6b400e3147dcfd8cc3a393ace1bd118c93762e0c","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/qt/qtbase/commit/202143ba41f6ac574f1858214ed8bf4a38b73ccd","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/qt/qtbase/commit/1ca02cf2879a5e1511a2f2109f0925cf4c892862","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35566","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-903.yaml","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://www.qt.io/blog/qt-5.15-extended-support-for-subscription-license-holders","tags":["x_transferred","Release Notes","advisory"]},{"url":"https://wiki.qt.io/Qt_5.15_Release#Known_Issues","tags":["x_transferred","Issue Tracking","Release Notes","Vendor Advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36VN2WKMNQUSTF6ZW2X52NPAJVXJ4S5I/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HY5YCSDCTLHVMP3OXOM6HNTWHV6DBHDX/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202402-03","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38593","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36VN2WKMNQUSTF6ZW2X52NPAJVXJ4S5I"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HY5YCSDCTLHVMP3OXOM6HNTWHV6DBHDX"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36VN2WKMNQUSTF6ZW2X52NPAJVXJ4S5I"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HY5YCSDCTLHVMP3OXOM6HNTWHV6DBHDX"},{"url":"https://github.com/advisories/GHSA-qfcf-2jfw-4cm8"},{"url":"https://errata.almalinux.org/8/ALSA-2022-1796.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-38593","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2021-0493.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29468","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5081-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2059","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2060","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1796","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994719","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1796.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-38593","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38593","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2022:1796","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-38593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-17507","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-38593","description":"Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).","status":"published","published":"2021-08-12T00:00:00Z","modified":"2026-11-02T18:05:43.133Z","updated_at":"2026-11-02T19:47:06.831391Z"}],"euvd":[{"id":"EUVD-2021-25035","description":"Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).","status":"published","published":"2021-08-12T00:00:00Z","modified":"2026-11-02T18:05:43Z","updated_at":"2026-11-03T05:08:39.228431Z"}],"ghsa":[{"id":"GHSA-qfcf-2jfw-4cm8","title":"Qt 5.0.0 through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from...","description":"Qt 5.0.0 through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).","status":"published","published":"2022-05-24T19:10:59Z","modified":"2026-11-02T21:32:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-03T00:02:49.048371Z"}],"nvd":[{"id":"CVE-2021-38593","description":"Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).","status":"published","published":"2021-08-12T02:15:06.58Z","modified":"2026-11-02T19:17:44.107Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-03T00:01:40.46005Z"}],"osv":[{"id":"AZL-34211","title":"CVE-2021-38593 affecting package qt5-qtbase for versions less than 5.12.11-11","description":"Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).","status":"published","published":"2021-08-12T02:15:06Z","modified":"2026-04-21T04:27:04.504306Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-6838","title":"CVE-2021-38593 affecting package qt5-qtsvg for versions less than 5.12.11-3","description":"Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).","status":"published","published":"2021-08-12T02:15:06Z","modified":"2026-04-21T04:38:24.715781Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"CVE-2021-38593","description":"Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).","status":"published","published":"2021-08-12T02:15:06.58Z","modified":"2026-11-04T07:07:02.856679491Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T07:32:23.735279Z"},{"id":"OESA-2022-2059","title":"qt5-qtbase security update","description":"Qt is a software toolkit for developing applications. This package contains base tools, like string, xml, and network handling.\r\n\r\nSecurity Fix(es):\r\n\r\nQt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).(CVE-2021-38593)","status":"published","published":"2022-11-11T11:05:22Z","modified":"2026-08-18T01:17:21.363507063Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2022-2060","title":"qt5-qtbase security update","description":"Qt is a software toolkit for developing applications. This package contains base tools, like string, xml, and network handling.\r\n\r\nSecurity Fix(es):\r\n\r\nQt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).(CVE-2021-38593)","status":"published","published":"2022-11-11T11:05:22Z","modified":"2026-08-18T01:17:21.460114946Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2022:1796","title":"Red Hat Security Advisory: qt5-qtbase security update","status":"published","published":"2024-09-16T06:38:23Z","modified":"2026-06-26T12:21:17.505063749Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:1796","title":"Moderate: qt5-qtbase security update","description":"Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. \n\nSecurity Fix(es):\n\n* qt: out-of-bounds write in QOutlineMapper::convertPath called from QRasterPaintEngine::fill and QPaintEngineEx::stroke (CVE-2021-38593)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.","status":"published","published":"2022-05-10T08:01:44Z","modified":"2026-02-04T19:15:13.081871Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-38593","description":"Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).","status":"published","published":"2021-08-12T02:15:00Z","modified":"2026-10-17T12:57:14.02789291Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"ALSA-2022:1796","title":"Moderate: qt5-qtbase security update","description":"Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. \n\nSecurity Fix(es):\n\n* qt: out-of-bounds write in QOutlineMapper::convertPath called from QRasterPaintEngine::fill and QPaintEngineEx::stroke (CVE-2021-38593)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-05-10T08:01:44Z","modified":"2026-10-29T11:01:16.035267031Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"MGASA-2021-0493","title":"Updated qtbase5 packages fix security vulnerability","description":"It was discovered that Qt incorrectly handled certain XBM image files. If a\nuser or automated system were tricked into opening a specially crafted PPM\nfile, a remote attacker could cause Qt to crash, resulting in a denial of\nservice. (CVE-2020-17507)\n\nIt was discovered that Qt incorrectly handled certain graphics operations.\nIf a user or automated system were tricked into performing certain graphics\noperations, a remote attacker could cause Qt to crash, resulting in a\ndenial of service. (CVE-2021-38593)\n","status":"published","published":"2021-10-27T12:13:28Z","modified":"2026-04-16T04:44:25.112966331Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"USN-5081-1","title":"qtbase-opensource-src vulnerabilities","description":"It was discovered that Qt incorrectly handled certain XBM image files. If a\nuser or automated system were tricked into opening a specially crafted PPM\nfile, a remote attacker could cause Qt to crash, resulting in a denial of\nservice. (CVE-2020-17507)\n\nIt was discovered that Qt incorrectly handled certain graphics operations.\nIf a user or automated system were tricked into performing certain graphics\noperations, a remote attacker could cause Qt to crash, resulting in a\ndenial of service. (CVE-2021-38593)\n","status":"published","published":"2021-09-16T16:34:02Z","modified":"2026-04-27T15:08:14.110495Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}