Segv on unknown address in dwg_ref_get_object in libredwg
Summary
OSV-2022-388: Segv on unknown address in dwg_ref_get_object. Affects libredwg versions >= 7bda865d59f843e174ac7e14c7dfe25243900956. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreDWG is an open-source library for reading and writing DWG files, which are the native file format for AutoCAD. It provides functionality to parse and manipulate DWG files, allowing developers to work with CAD data in their applications. However, a vulnerability has been discovered in the library that can lead to a segmentation fault (segv) when attempting to access an unknown address in the dwg_ref_get_object function.
Vulnerability Detail
The vulnerability in the dwg_ref_get_object function can result in a segmentation fault, causing the application to crash. This can potentially be exploited by an attacker to execute arbitrary code or cause a denial of service. The issue originates from a flaw in the handling of unknown addresses, leading to a crash when attempting to retrieve an object. The vulnerability has been reported through the OSS-Fuzz project, and more details can be found in the provided link.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
At the moment, there is no known workaround for this vulnerability. It is advised to apply the fix provided by the library maintainers as soon as possible.
Conclusion
In conclusion, the dwg_ref_get_object vulnerability in libredwg can lead to a segmentation fault and potential code execution or denial of service. It is crucial to update the affected package to a version that includes the fix. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libredwg →
FAQ
LibreDWG is an open-source library for reading and writing DWG files, the native file format for AutoCAD. It provides functionality to parse and manipulate DWG files in applications.
The vulnerability can lead to a segmentation fault, causing the application to crash. This can potentially be exploited by an attacker to execute arbitrary code or cause a denial of service.
The vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software to uncover potential security issues.
Yes, it is recommended to update the libredwg package to a version that includes the fix. Any version after commit 7bda865d59f843e174ac7e14c7dfe25243900956 should contain the necessary patches.
Currently, there are no known workarounds for this vulnerability. It is advised to apply the fix provided by the library maintainers.
References
Related vulnerabilities
Recent vulnerabilities recorded for libredwg.
