Summary
Cody Sixteen discovered that LibreCAD incorrectly
handled memory when parsing DXF files. An attacker could
use this issue to cause LibreCAD to crash, leading to a
denial of service. This issue only affected
Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-19105)
Lilith of Cisco Talos discovered that LibreCAD incorrectly
handled memory when parsing DWG files. An attacker could
use this issue to cause LibreCAD to crash, leading to a
denial of service, or possibly execute arbitrary code.
(CVE-2021-21898, CVE-2021-21899)
Lilith of Cisco Talos discovered that LibreCAD incorrectly
handled memory when parsing DRW files. An attacker could
use this issue to cause LibreCAD to crash, leading to a
denial of service, or possibly execute arbitrary code.
(CVE-2021-21900)
Albin Eldstål-Ahrens discovered that LibreCAD incorrectly
handled memory when parsing JWW files. An attacker could
use this issue to cause LibreCAD to crash, leading to a
denial of service, or possibly execute arbitrary code.
(CVE-2021-45341, CVE-2021-45342)
Albin Eldstål-Ahrens discovered that LibreCAD incorrectly
handled memory when parsing DXF files. An attacker could
use this issue to cause LibreCAD to crash, leading to a
denial of service. (CVE-2021-45343)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | librecad | 2.1.3-1.2+deb10u1build0.20.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | librecad | 2.0.9-2ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | librecad | 2.1.2-1ubuntu0.1~esm1 |
Vulnerabilities 7
-
High 8.8
A code execution vulnerability exists in the dwgCompressor::decompress18() functionality of LibreCad libdxfrw 2.2.0-rc2…
-
High 8.8
A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc…
-
High 8.8
A code execution vulnerability exists in the dxfRW::processLType() functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02…
-
Unscored —
LibreCAD 2.1.3 allows remote attackers to cause a denial of service (0x89C04589 write access violation and application …
-
Unscored —
A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker…
-
Unscored —
A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker…
-
Unscored —
In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the applica…
References
-
report
https://ubuntu.com/security/CVE-2018-19105
-
report
https://ubuntu.com/security/CVE-2021-21898
-
report
https://ubuntu.com/security/CVE-2021-21899
-
report
https://ubuntu.com/security/CVE-2021-21900
-
report
https://ubuntu.com/security/CVE-2021-45341
-
report
https://ubuntu.com/security/CVE-2021-45342
-
report
https://ubuntu.com/security/CVE-2021-45343