Heap-double-free vulnerability in libredwg
Summary
OSV-2023-1063: Heap-double-free in dwg_free_object. Affects libredwg versions >= 9811e30555064b7b560c326dd2cbb200e2e6a6f6, < 9801c8580ecabfd5770f927e5d71b0d1d184a55c. Fixed in 9801c8580ecabfd5770f927e5d71b0d1d184a55c. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibreDWG is an open-source library for reading and writing DWG files, which are the native file format for AutoCAD. It provides functionality to parse and manipulate DWG files, making it a crucial component for applications that work with AutoCAD files. However, a vulnerability has been discovered in the library that could lead to a heap-double-free error.
Vulnerability Detail
The heap-double-free vulnerability in libredwg arises from a flaw in the dwg_free_object function. This flaw can be triggered when the function attempts to free an object that has already been freed, leading to memory corruption. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The vulnerability has been assigned a high severity rating.
How To Fix
Minimum fixed version
9801c8580ecabfd5770f927e5d71b0d1d184a55c
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can avoid using the dwg_free_object function until the library is updated with the fix. Instead, they can implement their own memory management for freeing objects to mitigate the risk of triggering the heap-double-free vulnerability.
Conclusion
The heap-double-free vulnerability in libredwg can be addressed by updating the library to a version that includes the fix. Developers can also implement their own memory management as a workaround until the update is applied. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libredwg →
FAQ
LibreDWG is an open-source library for reading and writing DWG files, the native file format for AutoCAD. It provides functionality to parse and manipulate DWG files, making it a crucial component for applications that work with AutoCAD files.
A heap-double-free vulnerability occurs when a program attempts to free a memory object that has already been freed. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition.
An attacker can exploit this vulnerability by crafting a malicious DWG file that triggers the heap-double-free error in the dwg_free_object function. By exploiting this vulnerability, the attacker may be able to execute arbitrary code or crash the application.
This vulnerability has been assigned a high severity rating due to its potential to allow arbitrary code execution or cause a denial-of-service condition.
To protect your application from this vulnerability, it is recommended to update the libredwg library to a version that includes the fix. Additionally, you can implement proper input validation and sanitization to mitigate the risk of processing malicious DWG files.
References
Related vulnerabilities
Recent vulnerabilities recorded for libredwg.
