Heap-buffer-overflow in decode_preR13_section_hdr in libredwg
Summary
OSV-2022-377: Heap-buffer-overflow in decode_preR13_section_hdr. Affects libredwg versions >= 7bda865d59f843e174ac7e14c7dfe25243900956, < 580e8bbebf18579b97e2c20b032368b9079624ca. Fixed in 580e8bbebf18579b97e2c20b032368b9079624ca. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libredwg is an open-source library that provides functionality for reading and writing DWG files, which are the native file format used by AutoCAD. It is widely used in various applications that deal with CAD drawings. However, a vulnerability has been discovered in the library that can lead to a heap-buffer-overflow.
Vulnerability Detail
The vulnerability, identified as OSV-2022-377, originates from a heap-buffer-overflow WRITE 4 issue in the decode_preR13_section_hdr function of libredwg. This vulnerability can be triggered when processing a specific section header in a DWG file. An attacker could exploit this vulnerability to overwrite adjacent memory, potentially leading to arbitrary code execution or a denial of service. The vulnerability has been assigned a severity rating of HIGH.
How To Fix
Minimum fixed version
580e8bbebf18579b97e2c20b032368b9079624ca
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can consider implementing input validation and sanitization measures when processing DWG files using libredwg. By carefully validating the section headers and ensuring that they do not trigger the vulnerable code path, the risk of exploitation can be mitigated. However, applying the official fix is still strongly recommended.
Conclusion
In conclusion, libredwg is affected by a heap-buffer-overflow vulnerability in the decode_preR13_section_hdr function. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service. It is crucial for users of libredwg to update to a patched version of the library to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libredwg →
FAQ
libredwg is an open-source library for reading and writing DWG files, the native file format used by AutoCAD.
A heap-buffer-overflow is a type of memory corruption vulnerability where data is written beyond the bounds of a dynamically allocated buffer in the heap.
An attacker can exploit this vulnerability by crafting a malicious DWG file that triggers the vulnerable code path in libredwg, potentially leading to arbitrary code execution or a denial of service.
This vulnerability has been assigned a severity rating of HIGH.
Yes, a fix for this vulnerability is available in commit 580e8bbebf18579b97e2c20b032368b9079624ca or later versions of the libredwg library.
References
Related vulnerabilities
Recent vulnerabilities recorded for libredwg.
