U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): cpe:2.3:a:gnu:libredwg:0.4.549:*:*:*:*:*:*:*
  • CPE Name Search: true
There are 25 matching records.
Displaying matches 1 through 20.
Vuln ID Summary CVSS Severity
CVE-2023-26157

Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section->num_pages in decode_r2007.c.

Published: January 02, 2024; 12:15:08 AM -0500 		V3.1: 7.5 HIGH
 V2.0:(not available)
CVE-2022-35164

LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain.

Published: August 18, 2022; 1:15:07 AM -0400 		V3.1: 9.8 CRITICAL
 V2.0:(not available)
CVE-2021-42586

A heap buffer overflow was discovered in copy_bytes in decode_r2007.c in dwgread before 0.12.4 via a crafted dwg file.

Published: May 23, 2022; 7:16:10 AM -0400 		V3.1: 8.8 HIGH
 V2.0: 6.8 MEDIUM
CVE-2021-42585

A heap buffer overflow was discovered in copy_compressed_bytes in decode_r2007.c in dwgread before 0.12.4 via a crafted dwg file.

Published: May 23, 2022; 7:16:10 AM -0400 		V3.1: 8.8 HIGH
 V2.0: 6.8 MEDIUM
CVE-2021-39530

An issue was discovered in libredwg through v0.10.1.3751. bit_wcs2nlen() in bits.c has a heap-based buffer overflow.

Published: September 20, 2021; 12:15:12 PM -0400 		V3.1: 8.8 HIGH
 V2.0: 6.8 MEDIUM
CVE-2021-39528

An issue was discovered in libredwg through v0.10.1.3751. dwg_free_MATERIAL_private() in dwg.spec has a double free.

Published: September 20, 2021; 12:15:12 PM -0400 		V3.1: 8.8 HIGH
 V2.0: 6.8 MEDIUM
CVE-2021-39527

An issue was discovered in libredwg through v0.10.1.3751. appinfo_private() in decode.c has a heap-based buffer overflow.

Published: September 20, 2021; 12:15:12 PM -0400 		V3.1: 8.8 HIGH
 V2.0: 6.8 MEDIUM
CVE-2021-39525

An issue was discovered in libredwg through v0.10.1.3751. bit_read_fixed() in bits.c has a heap-based buffer overflow.

Published: September 20, 2021; 12:15:11 PM -0400 		V3.1: 8.8 HIGH
 V2.0: 6.8 MEDIUM
CVE-2021-39523

An issue was discovered in libredwg through v0.10.1.3751. A NULL pointer dereference exists in the function check_POLYLINE_handles() located in decode.c. It allows an attacker to cause Denial of Service.

Published: September 20, 2021; 12:15:11 PM -0400 		V3.1: 6.5 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2021-39522

An issue was discovered in libredwg through v0.10.1.3751. bit_wcs2len() in bits.c has a heap-based buffer overflow.

Published: September 20, 2021; 12:15:11 PM -0400 		V3.1: 8.8 HIGH
 V2.0: 6.8 MEDIUM
CVE-2021-39521

An issue was discovered in libredwg through v0.10.1.3751. A NULL pointer dereference exists in the function bit_read_BB() located in bits.c. It allows an attacker to cause Denial of Service.

Published: September 20, 2021; 12:15:11 PM -0400 		V3.1: 6.5 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2020-15807

GNU LibreDWG before 0.11 allows NULL pointer dereferences via crafted input files.

Published: July 17, 2020; 12:15:11 PM -0400 		V3.1: 6.5 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2019-20915

An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in bit_write_TF in bits.c.

Published: July 16, 2020; 2:15:13 PM -0400 		V3.1: 8.1 HIGH
 V2.0: 5.8 MEDIUM
CVE-2019-20914

An issue was discovered in GNU LibreDWG through 0.9.3. There is a NULL pointer dereference in the function dwg_encode_common_entity_handle_data in common_entity_handle_data.spec.

Published: July 16, 2020; 2:15:13 PM -0400 		V3.1: 9.8 CRITICAL
 V2.0: 7.5 HIGH
CVE-2019-20913

An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in dwg_encode_entity in common_entity_data.spec.

Published: July 16, 2020; 2:15:13 PM -0400 		V3.1: 8.1 HIGH
 V2.0: 5.8 MEDIUM
CVE-2019-20912

An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a stack overflow in bits.c, possibly related to bit_read_TF.

Published: July 16, 2020; 2:15:13 PM -0400 		V3.1: 8.8 HIGH
 V2.0: 6.8 MEDIUM
CVE-2019-20911

An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to denial of service in bit_calc_CRC in bits.c, related to a for loop.

Published: July 16, 2020; 2:15:13 PM -0400 		V3.1: 6.5 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2019-20910

An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in decode_R13_R2000 in decode.c, a different vulnerability than CVE-2019-20011.

Published: July 16, 2020; 2:15:13 PM -0400 		V3.1: 8.1 HIGH
 V2.0: 5.8 MEDIUM
CVE-2019-20909

An issue was discovered in GNU LibreDWG through 0.9.3. There is a NULL pointer dereference in the function dwg_encode_LWPOLYLINE in dwg.spec.

Published: July 16, 2020; 2:15:12 PM -0400 		V3.1: 7.5 HIGH
 V2.0: 5.0 MEDIUM
CVE-2019-20014

An issue was discovered in GNU LibreDWG before 0.93. There is a double-free in dwg_free in free.c.

Published: December 26, 2019; 8:15:13 PM -0500 		V3.1: 8.8 HIGH
 V2.0: 6.8 MEDIUM