A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon DCodeNumber parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5214 advisory.

  - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadXYCoord     coordinate parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted     gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger     this vulnerability. (CVE-2022-23803)

  - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadIJCoord     coordinate parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted     gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger     this vulnerability. (CVE-2022-23804)

  - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber     parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or     excellon file can lead to code execution. An attacker can provide a malicious file to trigger this     vulnerability. (CVE-2022-23946)

  - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon DCodeNumber     parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or     excellon file can lead to code execution. An attacker can provide a malicious file to trigger this     vulnerability. (CVE-2022-23947)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3078 advisory.

  - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadXYCoord     coordinate parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted     gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger     this vulnerability. (CVE-2022-23803)

  - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadIJCoord     coordinate parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted     gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger     this vulnerability. (CVE-2022-23804)

  - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber     parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or     excellon file can lead to code execution. An attacker can provide a malicious file to trigger this     vulnerability. (CVE-2022-23946)

  - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon DCodeNumber     parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or     excellon file can lead to code execution. An attacker can provide a malicious file to trigger this     vulnerability. (CVE-2022-23947)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2998 advisory.

  - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadXYCoord     coordinate parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted     gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger     this vulnerability. (CVE-2022-23803)

  - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadIJCoord     coordinate parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted     gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger     this vulnerability. (CVE-2022-23804)

  - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber     parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or     excellon file can lead to code execution. An attacker can provide a malicious file to trigger this     vulnerability. (CVE-2022-23946)

  - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon DCodeNumber     parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or     excellon file can lead to code execution. An attacker can provide a malicious file to trigger this     vulnerability. (CVE-2022-23947)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-78b18981a6 advisory.

  - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadXYCoord     coordinate parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted     gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger     this vulnerability. (CVE-2022-23803)

  - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadIJCoord     coordinate parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted     gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger     this vulnerability. (CVE-2022-23804)

  - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber     parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or     excellon file can lead to code execution. An attacker can provide a malicious file to trigger this     vulnerability. (CVE-2022-23946)

  - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon DCodeNumber     parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or     excellon file can lead to code execution. An attacker can provide a malicious file to trigger this     vulnerability. (CVE-2022-23947)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
164321	Debian DSA-5214-1 : kicad - security update	Nessus	Debian Local Security Checks	high
164317	Debian DLA-3078-1 : kicad - LTS security update	Nessus	Debian Local Security Checks	high
160978	Debian DLA-2998-1 : kicad - LTS security update	Nessus	Debian Local Security Checks	high
158557	Fedora 35 : 1:kicad (2022-78b18981a6)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2022-23947

high

Tenable Plugins

high

high

high

high