Advisories ยป MGASA-2022-0151

Updated libdxfrw packages fix security vulnerability

Publication date: 24 Apr 2022
Modification date: 24 Apr 2022
Type: security
Affected Mageia releases : 8
CVE: CVE-2021-21898 , CVE-2021-21899 , CVE-2021-21900 , CVE-2021-45343

Description

A code execution vulnerability exists in the dwgCompressor::decompress18()
functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted
.dwg file can lead to an out-of-bounds write. An attacker can provide a 
malicious file to trigger this vulnerability. (CVE-2021-21898)

A code execution vulnerability exists in the dwgCompressor::copyCompBytes21
functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted
.dwg file can lead to a heap buffer overflow. An attacker can provide a
malicious file to trigger this vulnerability. (CVE-2021-21899)

A code execution vulnerability exists in the dxfRW::processLType()
functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted
.dxf file can lead to a use-after-free vulnerability. An attacker can provide
a malicious file to trigger this vulnerability. (CVE-2021-21900)

In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw
allows an attacker to crash the application using a crafted DXF document.
(CVE-2021-45343)

References

SRPMS

8/core