Heap-buffer-overflow in bit_TV_to_utf8 in libredwg
Summary
OSV-2023-965: Heap-buffer-overflow in bit_TV_to_utf8. Affects libredwg versions >= 784605ad5b9c44ba9243158cb7b4a4bcc169f130, < 462607e556faf37a5cd2f75e4c1136e9836ae386. Fixed in 462607e556faf37a5cd2f75e4c1136e9836ae386. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libredwg is an open-source library that provides functionality for reading and writing DWG files, which are the native file format for AutoCAD. It is widely used in various applications that handle CAD drawings. However, a vulnerability has been discovered in the library that can lead to a heap-buffer-overflow.
Vulnerability Detail
The vulnerability in libredwg, specifically in the bit_TV_to_utf8 function, allows for a heap-buffer-overflow write. This can be triggered by a specially crafted input, potentially leading to a crash or arbitrary code execution. The issue was reported through the OSS-Fuzz project, and more details can be found in the provided link. The severity of this vulnerability is considered high.
How To Fix
Minimum fixed version
462607e556faf37a5cd2f75e4c1136e9836ae386
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is advised to apply the fix mentioned above as soon as possible.
Conclusion
In conclusion, libredwg is affected by a high-severity heap-buffer-overflow vulnerability in the bit_TV_to_utf8 function. It is crucial to update to a fixed version of the library to mitigate the risk of crashes or arbitrary code execution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libredwg →
FAQ
libredwg is an open-source library used for reading and writing DWG files, the native file format for AutoCAD.
A heap-buffer-overflow occurs when a program writes data beyond the bounds of a dynamically allocated buffer in the heap, potentially leading to crashes or code execution.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software.
The severity of this vulnerability is considered high.
Currently, there is no known workaround for this vulnerability. It is recommended to apply the provided fix as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for libredwg.
