PT-2021-24030 · Open Design Alliance · Open Design Alliance Drawings Sdk
Mat Powell
·
Published
2021-11-29
·
Updated
2021-12-07
·
CVE-2021-44044
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Open Design Alliance Drawings SDK versions prior to 2022.11
Description:
An out-of-bounds write issue exists when parsing JPG files, specifically when crafted data in a JPG (4 extraneous bytes before the marker 0xca) can trigger a write operation past the end of an allocated buffer. This can allow an attacker to execute code in the context of the current process.
Recommendations:
For versions prior to 2022.11, update to a version 2022.11 or later to resolve the issue. As a temporary workaround, consider restricting the use of JPG files with the Drawings SDK until a patch is available. Avoid using the Drawings SDK to parse JPG files with crafted data, specifically those containing 4 extraneous bytes before the marker 0xca, to minimize the risk of exploitation.
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Open Design Alliance Drawings Sdk