GNU LibreDWG 0.12.5 bits.c bit_write_TF heap-based overflow

Summaryinfo

A vulnerability was found in GNU LibreDWG 0.12.5 and classified as critical. Impacted is the function bit_write_TF of the file bits.c. Such manipulation leads to heap-based overflow. This vulnerability is uniquely identified as CVE-2023-36274. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, has been found in GNU LibreDWG 0.12.5 (Image Processing Software). Affected by this issue is the function bit_write_TF of the file bits.c. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. CVE summarizes:

LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_write_TF at bits.c.

The weakness was disclosed 06/23/2023 as 677. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2023-36274 since 06/21/2023. There are known technical details, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-40245). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Image Processing Software

Vendor

• GNU

Name

• LibreDWG

Version

• 0.12.5

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion