A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.

The remote host is affected by the vulnerability described in GLSA-202305-26 (LibreCAD: Multiple Vulnerabilities)

  - A code execution vulnerability exists in the dwgCompressor::decompress18() functionality of LibreCad     libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to an out-of-bounds write. An     attacker can provide a malicious file to trigger this vulnerability. (CVE-2021-21898)

  - A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad     libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to a heap buffer overflow. An     attacker can provide a malicious file to trigger this vulnerability. (CVE-2021-21899)

  - A code execution vulnerability exists in the dxfRW::processLType() functionality of LibreCad libdxfrw     2.2.0-rc2-19-ge02f3580. A specially-crafted .dxf file can lead to a use-after-free vulnerability. An     attacker can provide a malicious file to trigger this vulnerability. (CVE-2021-21900)

  - A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older     allows an attacker to achieve Remote Code Execution using a crafted JWW document. (CVE-2021-45341)

  - A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older     allows an attacker to achieve Remote Code Execution using a crafted JWW document. (CVE-2021-45342)

  - In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to     crash the application using a crafted DXF document. (CVE-2021-45343)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5957-1 advisory.

    Cody Sixteen discovered that LibreCAD incorrectly handled memory when parsing DXF files. An attacker could     use this issue to cause LibreCAD to crash, leading to a denial of service. This issue only affected Ubuntu     16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-19105)

    Lilith of Cisco Talos discovered that LibreCAD incorrectly handled memory when parsing DWG files. An     attacker could use this issue to cause LibreCAD to crash, leading to a denial of service, or possibly     execute arbitrary code. (CVE-2021-21898, CVE-2021-21899)

    Lilith of Cisco Talos discovered that LibreCAD incorrectly handled memory when parsing DRW files. An     attacker could use this issue to cause LibreCAD to crash, leading to a denial of service, or possibly     execute arbitrary code. (CVE-2021-21900)

    Albin Eldstl-Ahrens discovered that LibreCAD incorrectly handled memory when parsing JWW files. An     attacker could use this issue to cause LibreCAD to crash, leading to a denial of service, or possibly     execute arbitrary code. (CVE-2021-45341, CVE-2021-45342)

    Albin Eldstl-Ahrens discovered that LibreCAD incorrectly handled memory when parsing DXF files. An     attacker could use this issue to cause LibreCAD to crash, leading to a denial of service. (CVE-2021-45343)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2022-3dd3274ae2 advisory.

    Update to 2.2.0 RC4.

    ----

    Update librecad to 2.2.0 rc3. Apply fixes to libdxfrw and librecad for CVE-2021-45341, CVE-2021-45342,     CVE-2021-45343. This also resolves the issue where some dwg files no longer opened.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0143-1 advisory.

  - A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older     allows an attacker to achieve Remote Code Execution using a crafted JWW document. (CVE-2021-45341)

  - A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older     allows an attacker to achieve Remote Code Execution using a crafted JWW document. (CVE-2021-45342)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5077 advisory.

  - A code execution vulnerability exists in the dwgCompressor::decompress18() functionality of LibreCad     libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to an out-of-bounds write. An     attacker can provide a malicious file to trigger this vulnerability. (CVE-2021-21898)

  - A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad     libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to a heap buffer overflow. An     attacker can provide a malicious file to trigger this vulnerability. (CVE-2021-21899)

  - A code execution vulnerability exists in the dxfRW::processLType() functionality of LibreCad libdxfrw     2.2.0-rc2-19-ge02f3580. A specially-crafted .dxf file can lead to a use-after-free vulnerability. An     attacker can provide a malicious file to trigger this vulnerability. (CVE-2021-21900)

  - A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older     allows an attacker to achieve Remote Code Execution using a crafted JWW document. (CVE-2021-45341)

  - A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older     allows an attacker to achieve Remote Code Execution using a crafted JWW document. (CVE-2021-45342)

  - In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to     crash the application using a crafted DXF document. (CVE-2021-45343)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2908 advisory.

  - A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older     allows an attacker to achieve Remote Code Execution using a crafted JWW document. (CVE-2021-45341)

  - A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older     allows an attacker to achieve Remote Code Execution using a crafted JWW document. (CVE-2021-45342)

  - In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to     crash the application using a crafted DXF document. (CVE-2021-45343)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
176194	GLSA-202305-26 : LibreCAD: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
172590	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : LibreCAD vulnerabilities (USN-5957-1)	Nessus	Ubuntu Local Security Checks	high
169184	Fedora 35 : libdxfrw / librecad (2022-3dd3274ae2)	Nessus	Fedora Local Security Checks	high
161508	openSUSE 15 Security Update : librecad (openSUSE-SU-2022:0143-1)	Nessus	SuSE Local Security Checks	high
158089	Debian DSA-5077-1 : librecad - security update	Nessus	Debian Local Security Checks	high
157365	Debian DLA-2908-1 : librecad - LTS security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-45342

high

Tenable Plugins

high

high

high

high

high

high