CVE-2021-43280

CVE-2021-43280 concerns Open Design Alliance Drawings SDK (ODA) DWF file parsing. The root cause is a stack-based buffer overflow caused by insufficient validation of the length of user-supplied data before copying it to a stack buffer during DWF file reading. Affected component is the DWF parsin...

CVE-2021-43390

CVE-2021-43390 refers to an out-of-bounds write in the Open Design Alliance (ODA) Drawings SDK when parsing DGN files. The issue occurs due to improper validation of crafted DGN data, allowing a write past the end of a buffer and potentially enabling code execution in the attacker’s context. Affe...

CVE-2021-43279

CVE-2021-43279 is an out-of-bounds write in Open Design Alliance PRC SDK/U3D file parsing that can lead to remote code execution. The vulnerability affects Open Design Alliance PRC SDK before 2022.10 and the ODAViewer component handling U3D files. ZDI advisories describe remote code execution via...

CVE-2021-43279

An out-of-bounds write vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute...

CVE-2021-43278

The OBJ file reader in Open Design Alliance Drawings SDK (pre-2022.11) has an out-of-bounds read due to missing input-length validation in the OBJ parser. This can allow an attacker to execute code in the context of the affected process (remote code execution) via crafted OBJ data. The ZDI adviso...

CVE-2021-43277

CVE-2021-43277 is an out-of-bounds read in Open Design Alliance PRC SDK’s U3D file parsing. Crafted U3D data can trigger a read past the end of an allocated buffer, with the potential to execute arbitrary code in the context of the current process. This vulnerability is documented across multiple...

CVE-2021-43277

An out-of-bounds read vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute...

CVE-2021-43276

The CVE-2021-43276 entry concerns Open Design Alliance ODA Viewer prior to 2022.8, which contains an Out-of-bounds Read issue in DWF file parsing that can trigger a read past the end of an allocated buffer. The vulnerability could allow an attacker to execute arbitrary code in the context of the ...

CVE-2021-43276

An Out-of-bounds Read vulnerability exists in Open Design Alliance ODA Viewer before 2022.8. Crafted data in a DWF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the...

CVE-2021-43275

A Use After Free vulnerability exists in the DGN file reading procedure in Open Design Alliance Drawings SDK before 2022.8. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute...

CVE-2021-43275

CVE-2021-43275 affects Open Design Alliance Drawings SDK (ODA) prior to 2022.8, specifically the DGN file reading path. The issue is a Use-After-Free caused by not validating the existence of an object before performing operations on it, which can lead to code execution in the context of the curr...

CVE-2021-43274

Open Design Alliance Drawings SDK before 2022.11 contains a Use-After-Free in DWF parsing due to not validating object existence before operations. This can allow an attacker to execute arbitrary code in the current process when combined with other vulnerabilities. Affected component: ODAViewer/D...

CVE-2021-43274

A Use After Free Vulnerability exists in the Open Design Alliance Drawings SDK before 2022.11. The specific flaw exists within the parsing of DWF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage...

CVE-2021-43273

CVE-2021-43273 concerns Open Design Alliance Drawings SDK (and related ODAViewer/Drawings Explorer) with an Out-of-bounds read/write in DGN file parsing. Exploitation arises from crafted DGN data and insufficient input validation, potentially allowing code execution in the attacker’s context (rem...

CVE-2021-43273

An Out-of-bounds Read vulnerability exists in the DGN file reading procedure in Open Design Alliance Drawings SDK before 2022.11. Crafted data in a DGN file and lack of verification of input data can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability t...

CVE-2021-43391

An Out-of-Bounds Read vulnerability exists when reading a DXF file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DXF files. Crafted data in a DXF file an invalid dash counter in line types can trigger a read past the end of an allocated...

PT-2021-23825

Name of the Vulnerable Software and Affected Versions Open Design Alliance Drawings SDK versions prior to 2022.11 Description The issue exists within the parsing of DGN files, where crafted data and lack of proper validation of input data can trigger a write operation past the end of an allocated...

PT-2021-23800

Name of the Vulnerable Software and Affected Versions Open Design Alliance Drawings SDK versions prior to 2022.8 Description A stack-based buffer overflow vulnerability exists in the DWF file reading procedure due to the lack of proper validation of the length of user-supplied data before copying...

CVE-2021-43336

An Out-of-Bounds Write vulnerability exists when reading a DXF or DWG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DXF and DWG files. Crafted data in a DXF or DWG file an invalid number of properties can trigger a write operation pas...

CVE-2021-43391

CVE-2021-43391 affects Open Design Alliance Drawings SDK prior to 2022.11. The vulnerability is an out-of-bounds read during DXF parsing caused by an invalid dash counter in line types, which could allow code execution in the context of the current process. Siemens/connected advisories confirm af...