PT-2021-6582 · Ribbonsoft+2 · Dxflib+2

Lilith >_> · Published 2021-09-08 · Updated 2024-06-15 · CVE-2021-21897

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ribbonsoft dxflib version 3.17.0

Description A code execution issue exists in the DL Dxf::handleLWPolylineData functionality, related to a heap buffer overflow. This can be triggered by a specially-crafted .dxf file, allowing an attacker to potentially access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For version 3.17.0, consider disabling the DL Dxf::handleLWPolylineData functionality until a patch is available to prevent exploitation through malicious .dxf files. Restrict access to handling .dxf files to minimize the risk of triggering the heap buffer overflow. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Underflow

Memory Corruption

Weakness Enumeration

CWE-191

CWE-787

Related Identifiers

BDU:2022-01848

CVE-2021-21897

DLA-3046-1

OPENSUSE-SU-2022_0134-1

OPENSUSE-SU-2024:10730-1

Affected Products

Debian

Suse

Dxflib

References · 22

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1346 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-21897 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L2H36XRMAPQBIOVIIFX6KUT5YOG2ETM6 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DA4C4X5GMM65VYLUW7Q7YL6P5NDB633A · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IMGMEPTYL7WTQ333J6SMC6MUHDMMWT3O · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21897 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BUOTYU3KKIYE4BEBUFA4MRS462P3OWM · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01848 · Security Note
• https://osv.dev/vulnerability/DLA-3046-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10730-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21897 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-21897 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21897 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21897 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21897 · Security Note