{"id":"DEBIAN-CVE-2022-43591","details":"A buffer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an out-of-bounds memory access, which can lead to arbitrary code execution. Target application would need to access a malicious web page to trigger this vulnerability.","modified":"2026-09-01T20:04:49.888027792Z","published":"2023-01-12T17:15:09.523Z","upstream":["CVE-2022-43591"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-43591"}],"affected":[{"package":{"name":"qt6-declarative","ecosystem":"Debian:12","purl":"pkg:deb/debian/qt6-declarative?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2+dfsg~rc1-2"}]}],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-43591.json"}},{"package":{"name":"qt6-declarative","ecosystem":"Debian:13","purl":"pkg:deb/debian/qt6-declarative?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2+dfsg~rc1-2"}]}],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-43591.json"}},{"package":{"name":"qt6-declarative","ecosystem":"Debian:14","purl":"pkg:deb/debian/qt6-declarative?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2+dfsg~rc1-2"}]}],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-43591.json"}},{"package":{"name":"qtdeclarative-opensource-src","ecosystem":"Debian:12","purl":"pkg:deb/debian/qtdeclarative-opensource-src?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.10+dfsg-1","5.15.10+dfsg-2","5.15.10+dfsg-2+m68k","5.15.10+dfsg-2+m68k.1","5.15.11+dfsg-1","5.15.12+dfsg-1","5.15.13+dfsg-1","5.15.13+dfsg-2","5.15.13+dfsg-2+hurd.1","5.15.13+dfsg-2+loong64","5.15.13+dfsg-2+m68k","5.15.15+dfsg-1","5.15.15+dfsg-2","5.15.15+dfsg-2+hurd.1","5.15.15+dfsg-3","5.15.15+dfsg-3+m68k","5.15.16+dfsg-1","5.15.17+dfsg-1","5.15.17+dfsg-2","5.15.17+dfsg-2+hurd.1","5.15.17+dfsg-3","5.15.17+dfsg-4","5.15.18+dfsg-1","5.15.18+dfsg-2","5.15.19+dfsg-1","5.15.19+dfsg-2","5.15.8+dfsg-3","5.15.9+dfsg-1"],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-43591.json"}},{"package":{"name":"qtdeclarative-opensource-src","ecosystem":"Debian:13","purl":"pkg:deb/debian/qtdeclarative-opensource-src?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-3","5.15.15+dfsg-3+m68k","5.15.16+dfsg-1","5.15.17+dfsg-1","5.15.17+dfsg-2","5.15.17+dfsg-2+hurd.1","5.15.17+dfsg-3","5.15.17+dfsg-4","5.15.18+dfsg-1","5.15.18+dfsg-2","5.15.19+dfsg-1","5.15.19+dfsg-2"],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-43591.json"}},{"package":{"name":"qtdeclarative-opensource-src","ecosystem":"Debian:14","purl":"pkg:deb/debian/qtdeclarative-opensource-src?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-3","5.15.15+dfsg-3+m68k","5.15.16+dfsg-1","5.15.17+dfsg-1","5.15.17+dfsg-2","5.15.17+dfsg-2+hurd.1","5.15.17+dfsg-3","5.15.17+dfsg-4","5.15.18+dfsg-1","5.15.18+dfsg-2","5.15.19+dfsg-1","5.15.19+dfsg-2"],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-43591.json"}},{"package":{"name":"qtdeclarative-opensource-src-gles","ecosystem":"Debian:12","purl":"pkg:deb/debian/qtdeclarative-opensource-src-gles?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.10+dfsg-1","5.15.10+dfsg-2","5.15.10+dfsg-3","5.15.12+dfsg-1","5.15.13+dfsg-1","5.15.13+dfsg-2","5.15.13+dfsg-3","5.15.15+dfsg-1","5.15.15+dfsg-2","5.15.17+dfsg-1","5.15.17+dfsg-2","5.15.18+dfsg-1","5.15.19+dfsg-1","5.15.19+dfsg-2","5.15.8+dfsg-1","5.15.9+dfsg-1"],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-43591.json"}},{"package":{"name":"qtdeclarative-opensource-src-gles","ecosystem":"Debian:13","purl":"pkg:deb/debian/qtdeclarative-opensource-src-gles?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-2","5.15.17+dfsg-1","5.15.17+dfsg-2","5.15.18+dfsg-1","5.15.19+dfsg-1","5.15.19+dfsg-2"],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-43591.json"}},{"package":{"name":"qtdeclarative-opensource-src-gles","ecosystem":"Debian:14","purl":"pkg:deb/debian/qtdeclarative-opensource-src-gles?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-2","5.15.17+dfsg-1","5.15.17+dfsg-2","5.15.18+dfsg-1","5.15.19+dfsg-1","5.15.19+dfsg-2"],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-43591.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}