Out-of-bounds write in Qt - CVE-2021-45930

Vulnerability identifier: #VU78667

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-45930

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing untrusted input within QtPrivate::QCommonArrayOps::growAppend() function. A remote attacker can create a specially crafted SVG file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and crash the application.

Qt
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
Gentoo Linux
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Anolis OS
SUSE Linux Enterprise Workstation Extension 12
Basesystem Module
Desktop Applications Module
openSUSE Leap
Ubuntu
openEuler
Fedora
Telemetry Dashboard
Liquidware
Citrix Workspace App
Webex App VDI
Pair
Dell Peripheral Manager
Cisco Jabber
Cisco Webex Meetings
VMware Horizon Client
libqt4-qt3support-debuginfo
libqt4-sql-postgresql-32bit
libqt4
libqt4-devel-doc-data
libqt4-devel
libqt4-devel-doc-debugsource
libqt4-debuginfo
libqt4-linguist-debuginfo
libqt4-private-headers-devel
libqt4-devel-doc-debuginfo
libqt4-linguist
libqt4-devel-doc
libqt4-devel-debuginfo
libqt4-sql-postgresql-debuginfo
libqt4-sql-sqlite-debuginfo-32bit
libqt4-sql-mysql-debuginfo-32bit
libqt4-sql-unixODBC-32bit
libqt4-debugsource
libqt4-sql-mysql-32bit
libqt4-sql-sqlite
libqt4-x11-32bit
libqt4-qt3support-debuginfo-32bit
libqt4-sql-debuginfo-32bit
libqt4-x11-debuginfo-32bit
libqt4-sql-32bit
libqt4-qt3support-32bit
libqt4-32bit
qt4-x11-tools
libqt4-sql-mysql-debuginfo
libqt4-qt3support
libqt4-sql
libqt4-sql-sqlite-debuginfo
libqt4-x11-debuginfo
qt4-x11-tools-debuginfo
libqt4-sql-mysql
libqt4-x11
libqt4-sql-debuginfo
libqt4-debuginfo-32bit
libqt4-sql-sqlite-32bit
libqt4-sql-unixODBC-debuginfo-32bit
libqt4-sql-unixODBC-debuginfo
libqt4-sql-unixODBC
libqt4-sql-postgresql-debuginfo-32bit
libqt4-sql-postgresql
libqt4-sql-plugins-debugsource
libQt5Svg5
libqt5-qtsvg-private-headers-devel
libqt5-qtsvg-devel
libQt5Svg5-debuginfo
libqt5-qtsvg-debugsource
libqt5svg5 (Ubuntu package)
qt5-qtsvg
qt5-qtsvg-debuginfo
qt5-qtsvg-debugsource
qt5-qtsvg-devel
libQt5Svg5-32bit
libQt5Svg5-64bit
libQt5Svg5-64bit-debuginfo
libqt5-qtsvg-devel-64bit
libqt5-qtsvg-examples
libqt5-qtsvg-examples-debuginfo
libQt5Svg5-32bit-debuginfo
libqt5-qtsvg-devel-32bit
qt5-qtsvg-examples
qt5-qtsvg (Red Hat package)
mingw-qt5-qtsvg
dev-qt/qtsvg

Install updates from vendor's website.

Qt - addressed in versions 5.15.13, 6.2.2
Telemetry Dashboard - update to 1.1.0.6 on Thin OS 2405
Liquidware - update to 6.7.0.2.2 on Thin OS 2405
Cisco Jabber - update to 14.3.0.308378.11 on Thin OS 2405
Citrix Workspace App - update to 24.2.0.65.17 on Thin OS 2405
Webex App VDI - update to 44.2.0.28744.1 on Thin OS 2405
Cisco Webex Meetings - update to 44.2.0.76.2 on Thin OS 2405
VMware Horizon Client - update to 2312.1.8.12.1.5 on Thin OS 2405
Pair - update to 1.2.3
Dell Peripheral Manager - update to 1.7.3
libqt4-qt3support-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-postgresql-32bit - update to 4.8.7-8.19.1
libqt4 - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-devel-doc-data - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-devel - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-devel-doc-debugsource - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-linguist-debuginfo - update to 4.8.7-8.19.1
libqt4-private-headers-devel - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-devel-doc-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-linguist - update to 4.8.7-8.19.1
libqt4-devel-doc - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-devel-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-postgresql-debuginfo - update to 4.8.7-8.19.1
libqt4-sql-sqlite-debuginfo-32bit - update to 4.8.7-8.19.1
libqt4-sql-mysql-debuginfo-32bit - update to 4.8.7-8.19.1
libqt4-sql-unixODBC-32bit - update to 4.8.7-8.19.1
libqt4-debugsource - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-mysql-32bit - update to 4.8.7-8.19.1
libqt4-sql-sqlite - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-x11-32bit - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-qt3support-debuginfo-32bit - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-debuginfo-32bit - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-x11-debuginfo-32bit - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-32bit - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-qt3support-32bit - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-32bit - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
qt4-x11-tools - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-mysql-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-qt3support - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-sqlite-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-x11-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
qt4-x11-tools-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-mysql - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-x11 - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-debuginfo - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-debuginfo-32bit - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libqt4-sql-sqlite-32bit - update to 4.8.7-8.19.1
libqt4-sql-unixODBC-debuginfo-32bit - update to 4.8.7-8.19.1
libqt4-sql-unixODBC-debuginfo - update to 4.8.7-8.19.1
libqt4-sql-unixODBC - update to 4.8.7-8.19.1
libqt4-sql-postgresql-debuginfo-32bit - update to 4.8.7-8.19.1
libqt4-sql-postgresql - update to 4.8.7-8.19.1
libqt4-sql-plugins-debugsource - addressed in versions 4.8.7-8.19.1, 4.8.7-8.22.1
libQt5Svg5 - addressed in versions 5.6.2-3.11.1, 5.12.7-150200.3.8.1, 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libqt5-qtsvg-private-headers-devel - addressed in versions 5.6.2-3.11.1, 5.12.7-150200.3.8.1, 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libqt5-qtsvg-devel - addressed in versions 5.6.2-3.11.1, 5.12.7-150200.3.8.1, 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libQt5Svg5-debuginfo - addressed in versions 5.6.2-3.11.1, 5.12.7-150200.3.8.1, 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libqt5-qtsvg-debugsource - addressed in versions 5.6.2-3.11.1, 5.12.7-150200.3.8.1, 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libqt5svg5 (Ubuntu package) - update to 5.9.5-0ubuntu1.1
qt5-qtsvg - update to 5.11.1-6
qt5-qtsvg-debuginfo - update to 5.11.1-6
qt5-qtsvg-debugsource - update to 5.11.1-6
qt5-qtsvg-devel - update to 5.11.1-6
libQt5Svg5-32bit - addressed in versions 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libQt5Svg5-64bit - addressed in versions 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libQt5Svg5-64bit-debuginfo - addressed in versions 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libqt5-qtsvg-devel-64bit - addressed in versions 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libqt5-qtsvg-examples - addressed in versions 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libqt5-qtsvg-examples-debuginfo - addressed in versions 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libQt5Svg5-32bit-debuginfo - addressed in versions 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
libqt5-qtsvg-devel-32bit - addressed in versions 5.15.2+kde16-150400.3.3.1, 5.15.8+kde8-150500.3.3.1
qt5-qtsvg-examples - update to 5.15.2-4
qt5-qtsvg-devel - update to 5.15.2-4
qt5-qtsvg - update to 5.15.2-4
qt5-qtsvg (Red Hat package) - update to 5.15.2-4.el8
mingw-qt5-qtsvg - addressed in versions 5.15.2-6.fc34, 5.15.2-6.fc35
qt5-qtsvg - update to 5.15.2-6.fc35
dev-qt/qtsvg - update to 5.15.9-r1

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37025
• https://github.com/qt/qtsvg/commit/a3b753c2d077313fc9eb93af547051b956e383fc
• https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qt/OSV-2021-1121.yaml
• https://github.com/qt/qtsvg/commit/79bb9f51fa374106a612d17c9d98d35d807be670
• https://github.com/qt/qtsvg/commit/36cfd9efb9b22b891adee9c48d30202289cfa620
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37306
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V75XNX4GDB64N5BSOAN474RUXXS5OHRU/
• https://lists.debian.org/debian-lts-announce/2022/01/msg00020.html
• https://lists.debian.org/debian-lts-announce/2022/01/msg00022.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GKOKVCSDZSOWWR3HOW5XUIUJC4MKQY5/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GZIXNSX7FV733TWTTLY6FHSH3SCNQKKD/

• Denial of service in Qt
• SUSE update for libqt5-qtsvg
• SUSE update for libqt5-qtsvg
• SUSE update for libqt5-qtsvg
• SUSE update for libqt4
• SUSE update for libqt5-qtsvg
• openEuler update for qt5-qtsvg
• Multiple vulnerabilities in Dell Peripheral Manager
• Multiple vulnerabilities in Dell ThinOS
• Gentoo update for qtsvg
• Multiple vulnerabilities in Dell Pair
• Red Hat Enterprise Linux 8 update for qt5-qtsvg
• Ubuntu update for qtsvg-opensource-src
• Fedora 35 update for qt5-qtsvg
• Fedora 34 update for mingw-qt5-qtsvg
• Fedora 35 update for mingw-qt5-qtsvg
• Anolis OS update for qt5-qtsvg
• SUSE update for libqt4