Stack-buffer-overflow in dxf_header_read in libredwg
Summary
OSV-2023-1122: Stack-buffer-overflow in dxf_header_read. Affects libredwg versions >= 56b087fa0bdb5c5587f2e68f864a7240255f4d82, < 4e4547b96add1ddb4ef7036a9ddbde9806371104. Fixed in 4e4547b96add1ddb4ef7036a9ddbde9806371104. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libredwg is an open-source library for reading and writing DWG files, which are the native file format for AutoCAD. It provides functionality to parse and manipulate DWG files. However, a vulnerability has been discovered in the dxf_header_read function of libredwg, which can lead to a stack buffer overflow.
Vulnerability Detail
The vulnerability in dxf_header_read function of libredwg allows for a stack buffer overflow when reading DXF files. This can be triggered by a specially crafted DXF file, potentially leading to arbitrary code execution or a denial of service. The issue was reported through the OSS-Fuzz project and has been assigned a medium severity level.
How To Fix
Minimum fixed version
4e4547b96add1ddb4ef7036a9ddbde9806371104
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update libredwg to a fixed version.
Conclusion
The dxf_header_read function in libredwg is vulnerable to a stack buffer overflow. To mitigate this vulnerability, it is crucial to update libredwg to the latest version. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libredwg →
FAQ
libredwg is an open-source library for reading and writing DWG files, the native file format for AutoCAD.
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial of service by exploiting the stack buffer overflow.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software.
This vulnerability has been assigned a medium severity level.
No, there is no known workaround. Updating to a fixed version of libredwg is necessary.
References
Related vulnerabilities
Recent vulnerabilities recorded for libredwg.
