Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS commands via a crafted filename.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5229 advisory.

  - Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to     inject OS commands via a crafted filename. (CVE-2021-45844)

  - The Path Sanity Check script of FreeCAD 0.19 is vulnerable to OS command injection, allowing an attacker     to execute arbitrary commands via a crafted FCStd document. (CVE-2021-45845)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3076 advisory.

  - Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to     inject OS commands via a crafted filename. (CVE-2021-45844)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2934 advisory.

  - Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to     inject OS commands via a crafted filename. (CVE-2021-45844)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
165081	Debian DSA-5229-1 : freecad - security update	Nessus	Debian Local Security Checks	high
164284	Debian DLA-3076-1 : freecad - LTS security update	Nessus	Debian Local Security Checks	high
158675	Debian DLA-2934-1 : freecad - LTS security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-45844

high

Tenable Plugins

high

high

high