CVE catalog

CVE-2022-43591

qtdeclarative-opensource-src: CVE-2022-43591

Severity: Low
Published: Jan 15, 2023, 11:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.18% · Oct 25, 2026

A buffer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an out-of-bounds memory access, which can lead to arbitrary code execution. Target application would need to access a malicious web page to trigger this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	qt6-declarative	sid	`6.11.2+dfsg-3`	fixed
Debian	qt6-declarative	forky	`6.11.2+dfsg-3`	fixed
Debian	qt6-declarative	trixie	`6.8.2+dfsg-7`	fixed
Debian	qt6-declarative	bookworm	`6.4.2+dfsg-1`	fixed
Debian	qtdeclarative-opensource-src	sid	`5.15.19+dfsg-2`	vulnerable
Debian	qtdeclarative-opensource-src	forky	`5.15.19+dfsg-2`	vulnerable
Debian	qtdeclarative-opensource-src	trixie	`5.15.15+dfsg-3`	vulnerable
Debian	qtdeclarative-opensource-src	bookworm	`5.15.8+dfsg-3`	vulnerable
Debian	qtdeclarative-opensource-src-gles	sid	`5.15.19+dfsg-2`	vulnerable
Debian	qtdeclarative-opensource-src-gles	forky	`5.15.19+dfsg-2`	vulnerable
Debian	qtdeclarative-opensource-src-gles	trixie	`5.15.15+dfsg-2`	vulnerable
Debian	qtdeclarative-opensource-src-gles	bookworm	`5.15.8+dfsg-1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	qt6-declarative	source	sid	`6.4.2+dfsg~rc1-2`	unimportant	Not reported	Not reported
Debian	qt6-declarative	source	forky	`6.4.2+dfsg~rc1-2`	unimportant	Not reported	Not reported
Debian	qt6-declarative	source	trixie	`6.4.2+dfsg~rc1-2`	unimportant	Not reported	Not reported
Debian	qt6-declarative	source	bookworm	`6.4.2+dfsg~rc1-2`	unimportant	Not reported	Not reported
Debian	qtdeclarative-opensource-src	source	sid	`(unfixed)`	unimportant	Not reported	Not reported
Debian	qtdeclarative-opensource-src	source	forky	`(unfixed)`	unimportant	Not reported	Not reported
Debian	qtdeclarative-opensource-src	source	trixie	`(unfixed)`	unimportant	Not reported	Not reported
Debian	qtdeclarative-opensource-src	source	bookworm	`(unfixed)`	unimportant	Not reported	Not reported
Debian	qtdeclarative-opensource-src-gles	source	sid	`(unfixed)`	unimportant	Not reported	Not reported
Debian	qtdeclarative-opensource-src-gles	source	forky	`(unfixed)`	unimportant	Not reported	Not reported
Debian	qtdeclarative-opensource-src-gles	source	trixie	`(unfixed)`	unimportant	Not reported	Not reported
Debian	qtdeclarative-opensource-src-gles	source	bookworm	`(unfixed)`	unimportant	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libqt5qml5]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
[libqt5qmlmodels5]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
[libqt5qmlworkerscript5]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
[libqt5quick5]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
[libqt5quick5-gles]Affected
Source package: [qtdeclarative-opensource-src-gles]
Details (2)
- 5.15.8+dfsg-1 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src-gles · debian · bookworm
- 5.15.8+dfsg-1 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src-gles · debian · bookworm
[libqt5quickparticles5]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
[libqt5quickparticles5-gles]Affected
Source package: [qtdeclarative-opensource-src-gles]
Details (2)
- 5.15.8+dfsg-1 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src-gles · debian · bookworm
- 5.15.8+dfsg-1 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src-gles · debian · bookworm
[libqt5quickshapes5]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
[libqt5quicktest5]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
[libqt5quickwidgets5]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
[qml]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
[qml-module-qt-labs-animation]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
[qml-module-qt-labs-folderlistmodel]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
[qml-module-qt-labs-qmlmodels]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
[qml-module-qt-labs-settings]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
[qml-module-qt-labs-sharedimage]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
[qml-module-qt-labs-wavefrontmesh]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
[qml-module-qtqml]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
[qml-module-qtqml-models2]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
[qml-module-qtqml-statemachine]Affected
Source package: [qtdeclarative-opensource-src]
Details (2)
- 5.15.8+dfsg-3 · amd64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm
- 5.15.8+dfsg-3 · arm64 · bookworm
  Affected
  dsa · qtdeclarative-opensource-src · debian · bookworm

Next results

Observed: Oct 23, 2026, 6:30:19 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS]