{"id":"CVE-2021-38593","details":"Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).","modified":"2026-07-08T22:14:01.369747Z","published":"2021-08-12T02:15:06.580Z","related":["ALSA-2022:1796"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"35"},{"last_affected":"35"},{"introduced":"36"},{"last_affected":"36"}],"source":"CPE_STRING","vendor_product":"fedoraproject:fedora"}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36VN2WKMNQUSTF6ZW2X52NPAJVXJ4S5I/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HY5YCSDCTLHVMP3OXOM6HNTWHV6DBHDX/"},{"type":"ADVISORY","url":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-903.yaml"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202402-03"},{"type":"ADVISORY","url":"https://www.qt.io/blog/qt-5.15-extended-support-for-subscription-license-holders"},{"type":"REPORT","url":"https://wiki.qt.io/Qt_5.15_Release#Known_Issues"},{"type":"FIX","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35566"},{"type":"FIX","url":"https://github.com/qt/qtbase/commit/1ca02cf2879a5e1511a2f2109f0925cf4c892862"},{"type":"FIX","url":"https://github.com/qt/qtbase/commit/202143ba41f6ac574f1858214ed8bf4a38b73ccd"},{"type":"FIX","url":"https://github.com/qt/qtbase/commit/6b400e3147dcfd8cc3a393ace1bd118c93762e0c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/qt/qt5","events":[{"introduced":"0"},{"fixed":"6e27fd5679a4c373eaf8056909a9f3b7ae2ccb8a"},{"introduced":"78410d7e8b7aafdcbb4feea3a943038c7e0a0b5f"},{"last_affected":"3bb48b163f38eaaa4769779e506961b9038ec5d5"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.0.0"},{"fixed":"5.15.6"},{"introduced":"6.0.0"},{"last_affected":"6.1.2"}]}}],"versions":["v5.15.5-lts-lgpl","v5.15.4-lts-lgpl","v5.15.3-lts-lgpl","v6.1.2","v6.1.0-beta3","v6.1.0-beta2","v6.1.0-beta1","v6.1.0-alpha1","v6.0.0-beta5","v6.0.0-beta4","v6.0.0-beta3","v6.0.0-beta2","v6.0.0-beta1","v6.0.0-alpha1","v5.15.0-beta4","v5.15.0-beta3","v5.15.0-beta2","v5.15.0-beta1","v5.15.0-alpha1","v5.0.0-beta1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38593.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/qt/qtbase","events":[{"introduced":"3bf50a7db9a1add66fb66b7a1f9c1d3b038c5e7f"},{"fixed":"a5984e059385e93ab06eb95cbe12bea5215f7b9d"},{"introduced":"fc9cda5f08ac848e88f63dd4a07c08b2fbc6bf17"},{"last_affected":"4dcedb8ca4ae0c9c533997074098297abbfcf1c3"},{"fixed":"1ca02cf2879a5e1511a2f2109f0925cf4c892862"},{"fixed":"202143ba41f6ac574f1858214ed8bf4a38b73ccd"},{"fixed":"6b400e3147dcfd8cc3a393ace1bd118c93762e0c"}],"database_specific":{"cpe":"cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.0.0"},{"fixed":"5.15.6"},{"introduced":"6.0.0"},{"last_affected":"6.1.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38593.json","vanir_signatures_modified":"2026-07-08T22:14:01Z","vanir_signatures":[{"target":{"file":"src/gui/painting/qpaintengineex.cpp"},"deprecated":false,"digest":{"line_hashes":["271928562808682822601995538577538974780","72176071764742851516072444134726106676","163469072021631174261305783525076176707","213547461056257825045409429829012753748"],"threshold":0.9},"id":"CVE-2021-38593-10bb0601","signature_type":"Line","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/6b400e3147dcfd8cc3a393ace1bd118c93762e0c"},{"id":"CVE-2021-38593-22346b8a","signature_type":"Line","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/202143ba41f6ac574f1858214ed8bf4a38b73ccd","target":{"file":"src/gui/painting/qpaintengineex.cpp"},"deprecated":false,"digest":{"line_hashes":["271928562808682822601995538577538974780","72176071764742851516072444134726106676","163469072021631174261305783525076176707","213547461056257825045409429829012753748"],"threshold":0.9}},{"source":"https://github.com/qt/qtbase/commit/1ca02cf2879a5e1511a2f2109f0925cf4c892862","target":{"file":"src/gui/painting/qpaintengineex.cpp"},"deprecated":false,"digest":{"line_hashes":["271928562808682822601995538577538974780","72176071764742851516072444134726106676","163469072021631174261305783525076176707","213547461056257825045409429829012753748"],"threshold":0.9},"id":"CVE-2021-38593-2f99537b","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"66084939280504979425354887214909155133","length":6445},"id":"CVE-2021-38593-527772bf","signature_type":"Function","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/1ca02cf2879a5e1511a2f2109f0925cf4c892862","target":{"file":"src/gui/painting/qpaintengineex.cpp","function":"QPaintEngineEx::stroke"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/202143ba41f6ac574f1858214ed8bf4a38b73ccd","target":{"function":"QPaintEngineEx::stroke","file":"src/gui/painting/qpaintengineex.cpp"},"deprecated":false,"digest":{"function_hash":"66084939280504979425354887214909155133","length":6445},"id":"CVE-2021-38593-bbbd8d65"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/qt/qtbase/commit/6b400e3147dcfd8cc3a393ace1bd118c93762e0c","target":{"file":"src/gui/painting/qpaintengineex.cpp","function":"QPaintEngineEx::stroke"},"deprecated":false,"digest":{"function_hash":"66084939280504979425354887214909155133","length":6445},"id":"CVE-2021-38593-dabe698e"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}