CVE-2019-18281

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-18281
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-18281.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-18281
Downstream
Published
2019-10-23T15:15:14Z
Modified
2026-07-08T17:16:56Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVSS Calculator
Summary
[none]
Details

An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an application via a text file containing many directional characters.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "9.0"
                },
                {
                    "last_affected":  "9.0"
                },
                {
                    "introduced":  "10.0"
                },
                {
                    "last_affected":  "10.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "debian:debian_linux"
        }
    ]
}
References

Affected packages

Git / github.com/qt/qtbase

Affected ranges

Type
GIT
Repo
https://github.com/qt/qtbase
Events
Introduced
6eef81ee1c82f934e14d47047d8b6103b8755321
Last Affected
08de243eaa007597c2bfbc97d3d14e2f821ac4be
Introduced
13ed06640c6cf32ea8c784c896c6bf017053edb3
Fixed
abfb1b8665923ce2824392f3a04e5e4ac3871017
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "5.11.0"
        },
        {
            "last_affected":  "5.11.3"
        },
        {
            "introduced":  "5.12.0"
        },
        {
            "fixed":  "5.12.5"
        }
    ],
    "source":  "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-18281.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "42175485319852982382716562530548920112",
                "269969189790789914493321821784506182077",
                "192896421012310542730988811461340756350",
                "81493618896476637973500433905196848195",
                "177778031528303863734575949352642260045",
                "204261337458403320614169416449406855994",
                "282401848054897177864544170876498713116",
                "23956863597407661719760492111577731941",
                "120874335481434784682992640334932410074"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2019-18281-ce26650f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/qt/qtbase/commit/abfb1b8665923ce2824392f3a04e5e4ac3871017",
        "target":  {
            "file":  "qmake/generators/mac/pbuilder_pbx.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "55318626890648757947913378382764058604",
            "length":  55991
        },
        "id":  "CVE-2019-18281-f29a5ae7",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/qt/qtbase/commit/abfb1b8665923ce2824392f3a04e5e4ac3871017",
        "target":  {
            "file":  "qmake/generators/mac/pbuilder_pbx.cpp",
            "function":  "ProjectBuilderMakefileGenerator::writeMakeParts"
        }
    }
]
vanir_signatures_modified 
"2026-07-08T17:16:56Z"