Description
Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps<QPainterPath::Element>::growAppend (called from QPainterPath::addPath and QPathClipper::intersect).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qtsvg-opensource-src | 5.15.2-4 | — |
| Debian 13 | qtsvg-opensource-src | 5.15.2-4 | — |
| Debian 12 | qtsvg-opensource-src | 5.15.2-4 | — |
| Debian 10 | qt4-x11 | 4:4.8.7+dfsg-18+deb10u2 | DLA-3539-1 |
| Debian 9 | qt4-x11 | 4:4.8.7+dfsg-11+deb9u3 | DLA-2895-1 |
| Debian 9 | qtsvg-opensource-src | 5.7.1~20161021-2.1+deb9u1 | DLA-2885-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | qtsvg-opensource-src | 5.9.5-0ubuntu1.1 | USN-5241-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | qtsvg-opensource-src | 5.15.3-1ubuntu0.1~esm1 | USN-8337-1 |
| Ubuntu Pro 20.04 LTS | qtsvg-opensource-src | 5.12.8-0ubuntu1+esm1 | USN-8337-1 |
| Ubuntu Pro 18.04 LTS | qtsvg-opensource-src | 5.9.5-0ubuntu1.1+esm1 | USN-8337-1 |
| Ubuntu Pro 16.04 LTS | qtsvg-opensource-src | 5.5.1-2ubuntu0.1~esm1 | USN-8337-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | qt5-qtsvg +2 | 5.15.2-4.el8 | RHSA-2022:1920 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | qt5-qtsvg +2 | 5.15.2-4.el8 | ALSA-2022:1920 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | libqt5-qtsvg | 5.15.8+kde8-150500.3.3.1 | SUSE-SU-2023:2969-1 |
| SLES 15 SP4 | libqt5-qtsvg | 5.15.2+kde16-150400.3.3.1 | SUSE-SU-2023:2981-1 |
| SLES 12 SP5 | libqt4 +2 | 4.8.7-8.19.1 | SUSE-SU-2025:02968-1, SUSE-SU-2023:4622-1 |
| SLES 12 SP5 | libqt5-qtsvg | 5.6.2-3.11.1 | SUSE-SU-2023:2967-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | libqt4 +2 | 4.8.7-8.19.1 | SUSE-SU-2023:4622-1 |
| SLES for SAP 12 SP5 | libqt5-qtsvg | 5.6.2-3.11.1 | SUSE-SU-2023:2967-1 |
| SLE Real Time 15 SP3 | libqt5-qtsvg | 5.12.7-150200.3.8.1 | SUSE-SU-2023:3209-1 |
| SUSE Manager Server 4.2 | libqt5-qtsvg | 5.12.7-150200.3.8.1 | SUSE-SU-2023:3209-1 |
| SUSE Manager Proxy 4.2 | libqt5-qtsvg | 5.12.7-150200.3.8.1 | SUSE-SU-2023:3209-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.5 | libqt5-qtsvg | 5.15.8+kde8-150500.3.3.1 | SUSE-SU-2023:2969-1 |
| openSUSE Leap 15.4 | libqt5-qtsvg | 5.15.2+kde16-150400.3.3.1 | SUSE-SU-2023:2981-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | qt5-qtsvg +3 | 5.9.2-1.amzn2.0.2 | ALAS2-2023-1968 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | qt5-qtsvg +2 | 5.15.2-4.el8 | ELSA-2022-1920 |
Advisories 16
- ALSA-2022:1920 Moderate: qt5-qtsvg security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2023-0581 QT: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · May 28, 2026
- USN-8337-1 qtsvg-opensource-src vulnerabilities Ubuntu Security Notices (USN) · May 28, 2026
- USN-5241-1 qtsvg-opensource-src vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-3539-1 qt4-x11 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2895-1 qt4-x11 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2885-1 qtsvg-opensource-src - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2023:2969-1 Security update for libqt5-qtsvg SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:3209-1 Security update for libqt5-qtsvg SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4622-1 Security update for libqt4 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02968-1 Security update for libqt4 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2981-1 Security update for libqt5-qtsvg SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2967-1 Security update for libqt5-qtsvg SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2022:1920 Red Hat Security Advisory: qt5-qtsvg security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ALAS2-2023-1968 Moderate: qt5-qtsvg security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 7, 2023
- ELSA-2022-1920 Moderate: qt5-qtsvg security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 17, 2022
References
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-1121.yaml
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37025
- https://github.com/qt/qtsvg/commit/a3b753c2d077313fc9eb93af547051b956e383fc
- https://github.com/qt/qtsvg/commit/79bb9f51fa374106a612d17c9d98d35d807be670
- https://github.com/qt/qtsvg/commit/36cfd9efb9b22b891adee9c48d30202289cfa620
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37306
- FEDORA-2022-8e3fbc74e9 vendor-advisory
- [debian-lts-announce] 20220123 [SECURITY] [DLA 2885-1] qtsvg-opensource-src security update mailing-list
- [debian-lts-announce] 20220124 [SECURITY] [DLA 2895-1] qt4-x11 security update mailing-list
- FEDORA-2022-56f583fd79 vendor-advisory
- FEDORA-2022-1e29b8997a vendor-advisory
- [debian-lts-announce] 20230822 [SECURITY] [DLA 3539-1] qt4-x11 security update mailing-list