PT-2021-22609 · Libredwg · Libredwg

Seviezhou · Published 2021-09-20 · Updated 2021-09-24 · CVE-2021-39522

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: libredwg versions prior to v0.10.1.3751

Description: The issue is related to a heap-based buffer overflow in the bit wcs2len() function, located in bits.c. This overflow can occur due to improper handling of data, potentially leading to memory corruption and other security issues.

Recommendations: For versions prior to v0.10.1.3751, consider restricting access to the bit wcs2len() function in bits.c until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-39522

Affected Products

Libredwg

References · 4

• 🔥 https://github.com/LibreDWG/libredwg/issues/255 · Exploit
• https://osv.dev/vulnerability/CVE-2021-39522 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39522 · Security Note
• https://t.me/cvenotify/21428 · Telegram Post