Advisories ยป MGASA-2022-0295

Updated kicad packages fix security vulnerability

Publication date: 25 Aug 2022
Modification date: 25 Aug 2022
Type: security
Affected Mageia releases : 8
CVE: CVE-2022-23803 , CVE-2022-23804 , CVE-2022-23946 , CVE-2022-23947

Description

Multiple buffer overflows were discovered in Kicad, a suite of programs
for the creation of printed circuit boards, which could result in the
execution of arbitrary code if malformed Gerber/Excellon files, as
follows.

A stack-based buffer overflow vulnerability exists in the Gerber Viewer
gerber and excellon ReadXYCoord coordinate parsing functionality of KiCad
EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or
excellon file can lead to code execution. An attacker can provide a
malicious file to trigger this vulnerability. (CVE-2022-23803)

A stack-based buffer overflow vulnerability exists in the Gerber Viewer
gerber and excellon ReadIJCoord coordinate parsing functionality of KiCad
EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or
excellon file can lead to code execution. An attacker can provide a
malicious file to trigger this vulnerability. (CVE-2022-23804)

A stack-based buffer overflow vulnerability exists in the Gerber Viewer
gerber and excellon GCodeNumber parsing functionality of KiCad EDA 6.0.1
and master commit de006fc010. A specially-crafted gerber or excellon file
can lead to code execution. An attacker can provide a malicious file to
trigger this vulnerability. (CVE-2022-23946)

A stack-based buffer overflow vulnerability exists in the Gerber Viewer
gerber and excellon DCodeNumber parsing functionality of KiCad EDA 6.0.1
and master commit de006fc010. A specially-crafted gerber or excellon file
can lead to code execution. An attacker can provide a malicious file to
trigger this vulnerability. (CVE-2022-23947)

References

SRPMS

8/core