A vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily malformed!) properties may cause an out-of-bounds memory access when imported using import().

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily
    malformed!) properties may cause an out-of-bounds memory access when imported using import().
    (CVE-2022-0496)

  - A vulnerbiility was found in Openscad, where a .scad file with no trailing newline could cause an out-of-
    bounds read during parsing of annotations. (CVE-2022-0497)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily     malformed!) properties may cause an out-of-bounds memory access when imported using import().
    (CVE-2022-0496)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-2e64749f77 advisory.

    Automatic update for openscad-2021.01-8.fc37.

    ##### **Changelog**

    ```
    * Tue Apr  5 2022 Lumr Balhar <lbalhar@redhat.com> - 2021.01-8
    - Security fixes for CVE-2022-0496 and CVE-2022-0497
    - Fixes: rhbz#2050696 rhbz#2050700

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
426915	Alpine: multiple openscad packages: security update to 2021.01-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	high
426915	Alpine: multiple openscad packages: security update to 2021.01-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
229974	Linux Distros Unpatched Vulnerability : CVE-2022-0496	Nessus	Misc.	medium
211183	Fedora 37 : openscad (2022-2e64749f77)	Nessus	Fedora Local Security Checks	high
409768	Alpine: openscad: security update to 2021.01-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
409768	Alpine: openscad: security update to 2021.01-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high

Detections

Analytics

CVE-2022-0496

medium

Tenable Plugins

high

high

medium

high

high

high