CVE catalog
CVE-2021-38593
qtbase-opensource-src: CVE-2021-38593
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 3.00% · Oct 25, 2026
Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | qtbase-opensource-src | sid | 5.15.19+dfsg-6 | not affected |
| Debian | qtbase-opensource-src | forky | 5.15.19+dfsg-5 | not affected |
| Debian | qtbase-opensource-src | trixie | 5.15.15+dfsg-6+deb13u1 | not affected |
| Debian | qtbase-opensource-src | bookworm | 5.15.8+dfsg-11+deb12u3 | not affected |
| Debian | qtbase-opensource-src-gles | sid | 5.15.19+dfsg-2 | not affected |
| Debian | qtbase-opensource-src-gles | forky | 5.15.19+dfsg-2 | not affected |
| Debian | qtbase-opensource-src-gles | trixie | 5.15.15+dfsg-2 | not affected |
| Debian | qtbase-opensource-src-gles | bookworm | 5.15.8+dfsg-3 | not affected |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | qtbase-opensource-src | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | qtbase-opensource-src | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | qtbase-opensource-src | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | qtbase-opensource-src | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Debian | qtbase-opensource-src-gles | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | qtbase-opensource-src-gles | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | qtbase-opensource-src-gles | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | qtbase-opensource-src-gles | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libqt5concurrent5]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [libqt5core5a]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [libqt5dbus5]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [libqt5gui5]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [libqt5gui5-gles]Not affected
Source package: [qtbase-opensource-src-gles]
Details (2)
5.15.8+dfsg-3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src-gles · debian · bookworm
5.15.8+dfsg-3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src-gles · debian · bookworm
- [libqt5network5]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [libqt5opengl5]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [libqt5opengl5-dev]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [libqt5printsupport5]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [libqt5sql5]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [libqt5sql5-ibase]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [libqt5sql5-mysql]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [libqt5sql5-odbc]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [libqt5sql5-psql]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [libqt5sql5-sqlite]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [libqt5sql5-tds]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [libqt5test5]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [libqt5widgets5]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [libqt5xml5]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
- [qt5-flatpak-platformtheme]Not affected
Source package: [qtbase-opensource-src]
Details (2)
5.15.8+dfsg-11+deb12u3· amd64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
5.15.8+dfsg-11+deb12u3· arm64 · bookwormNot affected
dsa · qtbase-opensource-src · debian · bookworm
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2022_1796.json]
- [https://security-tracker.debian.org/tracker/CVE-2021-38593]
- [https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-38593.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2021/wid-sec-w-2022-0610.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]