Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The version of qt5-qtbase / qt5-qtsvg installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-38593 advisory.

  - Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath     (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke). (CVE-2021-38593)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202402-03 (QtGui: Multiple Vulnerabilities)

  - Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath     (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke). (CVE-2021-38593)

  - An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When     a SVG file with an image inside it is rendered, a QTextLayout buffer overflow can be triggered.
    (CVE-2023-32763)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:1796 advisory.

  - Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath     (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke). (CVE-2021-38593)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1967 advisory.

    Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath     (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke). (CVE-2021-38593)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-1796 advisory.

    [5.15.2-4]
    - Fix out-of-bounds write in QOutlineMapper::convertPath       Resolves: bz#1996877

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:1796 advisory.

  - Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath     (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke). (CVE-2021-38593)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1796 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qt: out-of-bounds write in QOutlineMapper::convertPath called from QRasterPaintEngine::fill and     QPaintEngineEx::stroke (CVE-2021-38593)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2022:1796 advisory.

  - qt: out-of-bounds write in QOutlineMapper::convertPath called from QRasterPaintEngine::fill and     QPaintEngineEx::stroke (CVE-2021-38593)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5081-1 advisory.

    It was discovered that Qt incorrectly handled certain XBM image files. If a user or automated system were     tricked into opening a specially crafted PPM file, a remote attacker could cause Qt to crash, resulting in     a denial of service. (CVE-2020-17507)

    It was discovered that Qt incorrectly handled certain graphics operations. If a user or automated system     were tricked into performing certain graphics operations, a remote attacker could cause Qt to crash,     resulting in a denial of service. (CVE-2021-38593)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195460	RHEL 6 : qt (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
195355	RHEL 7 : qt (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
191682	CBL Mariner 2.0 Security Update: qt5-qtbase / qt5-qtsvg (CVE-2021-38593)	Nessus	MarinerOS Local Security Checks	high
189967	GLSA-202402-03 : QtGui: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
184897	Rocky Linux 8 : qt5-qtbase (RLSA-2022:1796)	Nessus	Rocky Linux Local Security Checks	high
172157	Amazon Linux 2 : qt5-qtbase (ALAS-2023-1967)	Nessus	Amazon Linux Local Security Checks	high
161301	Oracle Linux 8 : qt5-qtbase (ELSA-2022-1796)	Nessus	Oracle Linux Local Security Checks	high
161147	AlmaLinux 8 : qt5-qtbase (ALSA-2022:1796)	Nessus	Alma Linux Local Security Checks	high
161051	RHEL 8 : qt5-qtbase (RHSA-2022:1796)	Nessus	Red Hat Local Security Checks	high
160916	CentOS 8 : qt5-qtbase (CESA-2022:1796)	Nessus	CentOS Local Security Checks	high
153446	Ubuntu 18.04 LTS : Qt vulnerabilities (USN-5081-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2021-38593

high

Tenable Plugins

critical

critical

high

high

high

high

high

high

high

high

high