Heap-buffer-overflow in bit_TV_to_utf8_codepage in libredwg
Summary
OSV-2023-717: Heap-buffer-overflow in bit_TV_to_utf8_codepage. Affects libredwg versions >= 10646ad0ed31d5291fc898d28b8c610586ef082e, < 97cc629fbea0d8d81b33ce382214578f3379de09. Fixed in 97cc629fbea0d8d81b33ce382214578f3379de09. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libredwg is an open-source library that provides functionality for working with DWG files. It is commonly used in applications that need to read and manipulate AutoCAD files. The library allows developers to parse DWG files and extract information such as geometry, layers, and text. However, a vulnerability has been discovered in the library that can lead to a heap-buffer-overflow when processing certain TV to UTF-8 codepage conversions.
Vulnerability Detail
The vulnerability in libredwg arises from a heap-buffer-overflow issue in the bit_TV_to_utf8_codepage function. This function is responsible for converting TV (Text Value) data to UTF-8 codepage. Due to a flaw in the code, an attacker can trigger a read overflow, potentially leading to arbitrary code execution or a denial-of-service condition. The vulnerability was reported through the OSS-Fuzz project and has been assigned a medium severity rating.
How To Fix
Minimum fixed version
97cc629fbea0d8d81b33ce382214578f3379de09
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At present, no official workaround has been provided for this vulnerability. Developers are advised to apply the fix mentioned in the 'how_to_fix' section or monitor the official libredwg repository for any further updates or workarounds that may be provided by the maintainers.
Conclusion
The heap-buffer-overflow vulnerability in libredwg's bit_TV_to_utf8_codepage function poses a potential security risk for applications that utilize the library for working with DWG files. It is crucial for developers to update their applications to use the patched version of libredwg and regularly update dependencies to ensure the latest security fixes are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libredwg →
FAQ
libredwg is an open-source library for parsing and manipulating DWG files, commonly used in applications that work with AutoCAD files.
A heap-buffer-overflow is a type of memory corruption vulnerability where data is written beyond the bounds of a dynamically allocated buffer in the heap, potentially leading to crashes, code execution, or other security issues.
This vulnerability was discovered through the OSS-Fuzz project, which applies fuzzing techniques to uncover security vulnerabilities in open-source software.
This vulnerability has been assigned a medium severity rating.
At present, no official workaround has been provided. It is recommended to apply the fix mentioned in the 'how_to_fix' section or monitor the official libredwg repository for any further updates or workarounds.
References
Related vulnerabilities
Recent vulnerabilities recorded for libredwg.
