Heap-buffer-overflow in libredwg: dxf_fixup_string
Summary
OSV-2023-997: Heap-buffer-overflow in dxf_fixup_string. Affects libredwg versions >= 0ad719902273a8a4d79c026d01ef2057c173579b, < b01634c896c29bb3a778daeef9e13ef115995610. Fixed in b01634c896c29bb3a778daeef9e13ef115995610. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libredwg is an open-source library for reading and writing DWG and DXF files. It provides functionality to parse and manipulate CAD drawings. The library is widely used in various applications that deal with CAD files. However, a vulnerability has been discovered in the library that could lead to a heap-buffer-overflow.
Vulnerability Detail
The vulnerability in libredwg, specifically in the function dxf_fixup_string, allows for a heap-buffer-overflow read of 1 byte. This vulnerability was reported through OSS-Fuzz, and the crash state indicates that the issue occurs during the processing of DXF layouts. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The severity of this vulnerability is considered medium.
How To Fix
Minimum fixed version
b01634c896c29bb3a778daeef9e13ef115995610
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is essential to apply the fix mentioned above to ensure the security of libredwg.
Conclusion
In conclusion, libredwg is affected by a medium-severity heap-buffer-overflow vulnerability in the dxf_fixup_string function. Users should update to the fixed version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libredwg →
FAQ
libredwg is an open-source library for reading and writing DWG and DXF files. It is commonly used in applications that deal with CAD drawings.
The vulnerability allows for a heap-buffer-overflow read, which could be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition.
This vulnerability was discovered through OSS-Fuzz, a continuous fuzzing service for open-source software.
The severity of this vulnerability is considered medium.
To fix this vulnerability, update libredwg to the fixed version b01634c896c29bb3a778daeef9e13ef115995610.
References
Related vulnerabilities
Recent vulnerabilities recorded for libredwg.
