Vulnerability · Published Aug 12, 2021 · Assigned by mitre
CVE-2021-38593
High 7.5
In plain English
A high-severity security flaw in the qt5-qtbase package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)3.0%top 12.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | qt5-qtbase | 5.15.2-4.el8 | ALSA-2022:1796 |
| AlmaLinux:8 | qt5-qtbase-common | 5.15.2-4.el8 | ALSA-2022:1796 |
| AlmaLinux:8 | qt5-qtbase-devel | 5.15.2-4.el8 | ALSA-2022:1796 |
| AlmaLinux:8 | qt5-qtbase-examples | 5.15.2-4.el8 | ALSA-2022:1796 |
| AlmaLinux:8 | qt5-qtbase-gui | 5.15.2-4.el8 | ALSA-2022:1796 |
| AlmaLinux:8 | qt5-qtbase-mysql | 5.15.2-4.el8 | ALSA-2022:1796 |
| AlmaLinux:8 | qt5-qtbase-odbc | 5.15.2-4.el8 | ALSA-2022:1796 |
| AlmaLinux:8 | qt5-qtbase-postgresql | 5.15.2-4.el8 | ALSA-2022:1796 |
| AlmaLinux:8 | qt5-qtbase-private-devel | 5.15.2-4.el8 | ALSA-2022:1796 |
| AlmaLinux:8 | qt5-qtbase-static | 5.15.2-4.el8 | ALSA-2022:1796 |
| Rocky Linux:8 | qt5-qtbase | 0:5.15.2-4.el8 | RLSA-2022:1796 |
| Ubuntu:22.04:LTS | qtbase-opensource-src-gles | no fix listed | UBUNTU-CVE-2021-38593 |
| Ubuntu:24.04:LTS | qtbase-opensource-src-gles | no fix listed | UBUNTU-CVE-2021-38593 |
| Ubuntu:25.10 | qtbase-opensource-src-gles | no fix listed | UBUNTU-CVE-2021-38593 |
| Ubuntu:26.04:LTS | qtbase-opensource-src-gles | no fix listed | UBUNTU-CVE-2021-38593 |
| Ubuntu:26.10 | qtbase-opensource-src-gles | no fix listed | UBUNTU-CVE-2021-38593 |
Affected products (as reported)
References
- https://github.com/qt/qtbase/commit/6b400e3147dcfd8cc3a393ace1bd118c93762e0c
- https://github.com/qt/qtbase/commit/202143ba41f6ac574f1858214ed8bf4a38b73ccd
- https://github.com/qt/qtbase/commit/1ca02cf2879a5e1511a2f2109f0925cf4c892862
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35566
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-903.yaml
- https://www.qt.io/blog/qt-5.15-extended-support-for-subscription-license-holders
- https://wiki.qt.io/Qt_5.15_Release#Known_Issues
- FEDORA-2022-54760f7fa4 vendor-advisory
- FEDORA-2022-4131ced81a vendor-advisory
- GLSA-202402-03 vendor-advisory