CVE-2021-38593: fedoraproject fedora Out-of-bounds Write
CVSS: 7.5v3.1HighModified
AliasesRHSA-2022:1796UBUNTU-CVE-2021-38593
Published 12-08-2021Last modified 04-08-2024
Vulnerability summary
CVE-2021-38593 is a high (CVSS 7.5) Out-of-bounds Write vulnerability in fedoraproject fedora. EPSS estimates a 3.00% chance of exploitation in the next 30 days, higher than 87.1% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
3.00%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 12-08-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
3.00%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 3.00% on 18-09-2026
18-09-202618-10-2026
EPSS score3.00%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat19 products
- qt5-qtbase< 0:5.15.2-4.el8
- qt5-qtbase-common< 0:5.15.2-4.el8
- qt5-qtbase-debuginfo< 0:5.15.2-4.el8
- qt5-qtbase-debugsource< 0:5.15.2-4.el8
- qt5-qtbase-devel< 0:5.15.2-4.el8
Ubuntu2 products
- qtbase-opensource-src< 5.9.5+dfsg-0ubuntu2.6 | < 5.12.8+dfsg-0ubuntu2.1
- qtbase-opensource-src-glesAll versions (No fix recorded)
Fedoraproject1 product
- fedoraEOL35 | 36
Qt1 product
- qt≥ 5.0.0, < 5.15.6 | ≥ 6.0.0, ≤ 6.1.2
4 vendors · 23 products
References
20 links- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- security.gentoo.org/glsa/202402-03Vendor Advisory
