# CVE-2019-18281: python-qt5-rpm-macros: Qt is a software toolkit for developing applications

CVE-2019-18281 is fixed in 89 products on 1 platform, first by RHSA-2020:1665, released April 29, 2020. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2019-18281
- Priority: Routine
- CVSS: 4.3 (Moderate)
- EPSS: 0.0205
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 29, 2020

## Description

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.  The following packages have been upgraded to a later upstream version: qt5 (5.12.5), qt5-qt3d (5.12.5), qt5-qtbase (5.12.5), qt5-qtcanvas3d (5.12.5), qt5-qtconnectivity (5.12.5), qt5-qtdeclarative (5.12.5), qt5-qtdoc (5.12.5), qt5-qtgraphicaleffects (5.12.5), qt5-qtimageformats (5.12.5), qt5-qtlocation (5.12.5), qt5-qtmultimedia (5.12.5), qt5-qtquickcontrols (5.12.5), qt5-qtquickcontrols2 (5.12.5), qt5-qtscript (5.12.5), qt5-qtsensors (5.12.5), qt5-qtserialbus (5.12.5), qt5-qtserialport (5.12.5), qt5-qtsvg (5.12.5), qt5-qttools (5.12.5), qt5-qttranslations (5.12.5), qt5-qtwayland (5.12.5), qt5-qtwebchannel (5.12.5), qt5-qtwebsockets (5.12.5), qt5-qtx11extras (5.12.5), qt5-qtxmlpatterns (5.12.5), python-qt5 (5.13.1), sip (4.19.19). (BZ#1775603, BZ#1775604)  Security Fix(es):  * qt: Malformed PPM image causing division by zero and crash in qppmhandler.cpp (CVE-2018-19872)  * qt5-qtsvg: Invalid parsing of malformed url reference resulting in a denial of service (CVE-2018-19869)  * qt5-qtimageformats: QTgaFile CPU exhaustion (CVE-2018-19871)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  Additional Changes:  For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes linked from the References section.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | python-qt5-rpm-macros RHEL 8 | 0:5.13.1-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | python3-pyqt5-sip RHEL 8 | 0:4.19.19-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | python3-qt5 RHEL 8 | 0:5.13.1-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | python3-qt5-base RHEL 8 | 0:5.13.1-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | python3-qt5-devel RHEL 8 | 0:5.13.1-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | python3-sip-devel RHEL 8 | 0:4.19.19-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qgnomeplatform RHEL 8 | 0:0.4-3.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-assistant RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-designer RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-devel RHEL 8 | 0:5.12.5-3.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-doctools RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-linguist RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qdbusviewer RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qt3d RHEL 8 | 0:5.12.5-2.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qt3d-devel RHEL 8 | 0:5.12.5-2.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qt3d-examples RHEL 8 | 0:5.12.5-2.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtbase RHEL 8 | 0:5.12.5-4.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtbase-common RHEL 8 | 0:5.12.5-4.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtbase-devel RHEL 8 | 0:5.12.5-4.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtbase-examples RHEL 8 | 0:5.12.5-4.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtbase-gui RHEL 8 | 0:5.12.5-4.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtbase-mysql RHEL 8 | 0:5.12.5-4.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtbase-odbc RHEL 8 | 0:5.12.5-4.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtbase-postgresql RHEL 8 | 0:5.12.5-4.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtbase-private-devel RHEL 8 | 0:5.12.5-4.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtbase-static RHEL 8 | 0:5.12.5-4.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtcanvas3d RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtcanvas3d-examples RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtconnectivity RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtconnectivity-devel RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtconnectivity-examples RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtdeclarative RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtdeclarative-devel RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtdeclarative-examples RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtdeclarative-static RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtdoc RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtgraphicaleffects RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtimageformats RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtlocation RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtlocation-devel RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtlocation-examples RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtmultimedia RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtmultimedia-devel RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtmultimedia-examples RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtquickcontrols RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtquickcontrols-examples RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtquickcontrols2 RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtquickcontrols2-devel RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtquickcontrols2-examples RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtscript RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtscript-devel RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtscript-examples RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtsensors RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtsensors-devel RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtsensors-examples RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtserialbus RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtserialbus-examples RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtserialport RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtserialport-devel RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtserialport-examples RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtsvg RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtsvg-devel RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtsvg-examples RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qttools RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qttools-common RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qttools-devel RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qttools-examples RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qttools-libs-designer RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qttools-libs-designercomponents RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qttools-libs-help RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qttools-static RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qttranslations RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtwayland RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtwayland-devel RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtwayland-examples RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtwebchannel RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtwebchannel-devel RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtwebchannel-examples RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtwebsockets RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtwebsockets-devel RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtwebsockets-examples RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtx11extras RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtx11extras-devel RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtxmlpatterns RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtxmlpatterns-devel RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-qtxmlpatterns-examples RHEL 8 | 0:5.12.5-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-rpm-macros RHEL 8 | 0:5.12.5-3.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | qt5-srpm-macros RHEL 8 | 0:5.12.5-3.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |
| Linux | sip RHEL 8 | 0:4.19.19-1.el8 | [RHSA-2020:1665](https://patchblox.com/security/data/fix/linux/rhsa-2020-1665.md) | Apr 29, 2020 |

---

Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.