A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.

The remote host is affected by the vulnerability described in GLSA-202305-26 (LibreCAD: Multiple Vulnerabilities)

  - A code execution vulnerability exists in the dwgCompressor::decompress18() functionality of LibreCad     libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to an out-of-bounds write. An     attacker can provide a malicious file to trigger this vulnerability. (CVE-2021-21898)

  - A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad     libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to a heap buffer overflow. An     attacker can provide a malicious file to trigger this vulnerability. (CVE-2021-21899)

  - A code execution vulnerability exists in the dxfRW::processLType() functionality of LibreCad libdxfrw     2.2.0-rc2-19-ge02f3580. A specially-crafted .dxf file can lead to a use-after-free vulnerability. An     attacker can provide a malicious file to trigger this vulnerability. (CVE-2021-21900)

  - A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older     allows an attacker to achieve Remote Code Execution using a crafted JWW document. (CVE-2021-45341)

  - A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older     allows an attacker to achieve Remote Code Execution using a crafted JWW document. (CVE-2021-45342)

  - In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to     crash the application using a crafted DXF document. (CVE-2021-45343)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5957-1 advisory.

    Cody Sixteen discovered that LibreCAD incorrectly handled memory when parsing DXF files. An attacker could     use this issue to cause LibreCAD to crash, leading to a denial of service. This issue only affected Ubuntu     16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-19105)

    Lilith of Cisco Talos discovered that LibreCAD incorrectly handled memory when parsing DWG files. An     attacker could use this issue to cause LibreCAD to crash, leading to a denial of service, or possibly     execute arbitrary code. (CVE-2021-21898, CVE-2021-21899)

    Lilith of Cisco Talos discovered that LibreCAD incorrectly handled memory when parsing DRW files. An     attacker could use this issue to cause LibreCAD to crash, leading to a denial of service, or possibly     execute arbitrary code. (CVE-2021-21900)

    Albin Eldstl-Ahrens discovered that LibreCAD incorrectly handled memory when parsing JWW files. An     attacker could use this issue to cause LibreCAD to crash, leading to a denial of service, or possibly     execute arbitrary code. (CVE-2021-45341, CVE-2021-45342)

    Albin Eldstl-Ahrens discovered that LibreCAD incorrectly handled memory when parsing DXF files. An     attacker could use this issue to cause LibreCAD to crash, leading to a denial of service. (CVE-2021-45343)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2022-3dd3274ae2 advisory.

    Update to 2.2.0 RC4.

    ----

    Update librecad to 2.2.0 rc3. Apply fixes to libdxfrw and librecad for CVE-2021-45341, CVE-2021-45342,     CVE-2021-45343. This also resolves the issue where some dwg files no longer opened.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0143-1 advisory.

  - A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older     allows an attacker to achieve Remote Code Execution using a crafted JWW document. (CVE-2021-45341)

  - A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older     allows an attacker to achieve Remote Code Execution using a crafted JWW document. (CVE-2021-45342)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5077 advisory.

    Multiple security issues were discovered in LibreCAD, an application for computer aided design (CAD) which     could result in denial of service or the execution of arbitrary code if a malformed CAD file is opened.
    For the oldstable distribution (buster), these problems have been fixed in version 2.1.3-1.2+deb10u1. For     the stable distribution (bullseye), these problems have been fixed in version 2.1.3-1.3+deb11u1. We     recommend that you upgrade your librecad packages. For the detailed security status of librecad please     refer to its security tracker page at: https://security-tracker.debian.org/tracker/librecad

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2908 advisory.

    Several security vulnerabilities have been discovered in librecad, a computer-aided design (CAD) system.
    Buffer overflows may lead to remote code execution if a specially crafted JWW document is processed. For     Debian 9 stretch, these problems have been fixed in version 2.1.2-1+deb9u3. We recommend that you upgrade     your librecad packages. For the detailed security status of librecad please refer to its security tracker     page at: https://security-tracker.debian.org/tracker/librecad Further information about Debian LTS     security advisories, how to apply these updates to your system and frequently asked questions can be found     at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
176194	GLSA-202305-26 : LibreCAD: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
172590	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : LibreCAD vulnerabilities (USN-5957-1)	Nessus	Ubuntu Local Security Checks	Local	high
169184	Fedora 35 : libdxfrw / librecad (2022-3dd3274ae2)	Nessus	Fedora Local Security Checks	Local	high
161508	openSUSE 15 Security Update : librecad (openSUSE-SU-2022:0143-1)	Nessus	SuSE Local Security Checks	Local	high
158089	Debian DSA-5077-1 : librecad - security update	Nessus	Debian Local Security Checks	Local	high
157365	Debian DLA-2908-1 : librecad - LTS security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2021-45341

high

Tenable Plugins

high

high

high

high

high

high