Out-of-Bounds Write Vulnerability in LibreDWG Affects Multiple Versions
CVE-2021-45950

6.5MEDIUM

Key Information:

Vendor
Gnu
Status
Libredwg
Vendor
CVE Published:
1 January 2022

Summary

LibreDWG versions 0.12.4.4313 through 0.12.4.4367 suffer from an out-of-bounds write vulnerability in the dwg_free_BLOCK_private function. This flaw can potentially lead to memory corruption, enabling attackers to exploit the software inadvertently, thus compromising the application's security and stability. Timely patching of the affected versions is strongly advised to mitigate potential security risks.

References

https://github.com/google/oss-fuzz-vulns/blob/main/vulns/...
x_refsource_MISC
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34766
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.