Description
GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' property type value to crash dwgread, dwg2dxf, or any application using LibreDWG.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
GNU LibreDWG
Default version status: unaffected
0 to ≤ 0.14.8612affected
pkg:github/LibreDWG/libredwgReferences
- https://hackmd.io/@haind-pwn/libredwg-acds-schema-prop-type-oob-read ↗
- https://github.com/LibreDWG/libredwg/blob/d9468ae948b8f07a08efa756c19f8916052358c0/src/acds.spec#L250-L260 ↗
- https://github.com/LibreDWG/libredwg ↗
- https://www.vulncheck.com/advisories/gnu-libredwg-through-0.14.8612-out-of-bounds-read-in-acds-private-acds-decoder ↗