Stack overflow

A stack-based buffer overflow vulnerability exists in the DWF file reading procedure in Open Design Alliance Drawings SDK before 2022.8. The issue results from the lack of proper validation of the length of user-supplied data before copying it to a stack-based buffer. An attacker can leverage thi...

CVE-2021-43274

A Use After Free Vulnerability exists in the Open Design Alliance Drawings SDK before 2022.11. The specific flaw exists within the parsing of DWF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage...

CVE-2021-43390

An Out-of-Bounds Write vulnerability exists when reading a DGN file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DGN files. Crafted data in a DGN file and lack of proper validation of input data can trigger a write operation past the end ...

CVE-2021-43280

CVE-2021-43280 concerns Open Design Alliance Drawings SDK (ODA) DWF file parsing. The root cause is a stack-based buffer overflow caused by insufficient validation of the length of user-supplied data before copying it to a stack buffer during DWF file reading. Affected component is the DWF parsin...

CVE-2021-43280

A stack-based buffer overflow vulnerability exists in the DWF file reading procedure in Open Design Alliance Drawings SDK before 2022.8. The issue results from the lack of proper validation of the length of user-supplied data before copying it to a stack-based buffer. An attacker can leverage thi...

CVE-2021-43390

CVE-2021-43390 refers to an out-of-bounds write in the Open Design Alliance (ODA) Drawings SDK when parsing DGN files. The issue occurs due to improper validation of crafted DGN data, allowing a write past the end of a buffer and potentially enabling code execution in the attacker’s context. Affe...

CVE-2021-43279

An out-of-bounds write vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute...

CVE-2021-43279

CVE-2021-43279 is an out-of-bounds write in Open Design Alliance PRC SDK/U3D file parsing that can lead to remote code execution. The vulnerability affects Open Design Alliance PRC SDK before 2022.10 and the ODAViewer component handling U3D files. ZDI advisories describe remote code execution via...

CVE-2021-43278

The OBJ file reader in Open Design Alliance Drawings SDK (pre-2022.11) has an out-of-bounds read due to missing input-length validation in the OBJ parser. This can allow an attacker to execute code in the context of the affected process (remote code execution) via crafted OBJ data. The ZDI adviso...

CVE-2021-43277

An out-of-bounds read vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute...

CVE-2021-43277

CVE-2021-43277 is an out-of-bounds read in Open Design Alliance PRC SDK’s U3D file parsing. Crafted U3D data can trigger a read past the end of an allocated buffer, with the potential to execute arbitrary code in the context of the current process. This vulnerability is documented across multiple...

CVE-2021-43275

A Use After Free vulnerability exists in the DGN file reading procedure in Open Design Alliance Drawings SDK before 2022.8. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute...

CVE-2021-43275

CVE-2021-43275 affects Open Design Alliance Drawings SDK (ODA) prior to 2022.8, specifically the DGN file reading path. The issue is a Use-After-Free caused by not validating the existence of an object before performing operations on it, which can lead to code execution in the context of the curr...

CVE-2021-43274

A Use After Free Vulnerability exists in the Open Design Alliance Drawings SDK before 2022.11. The specific flaw exists within the parsing of DWF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage...

CVE-2021-43274

Open Design Alliance Drawings SDK before 2022.11 contains a Use-After-Free in DWF parsing due to not validating object existence before operations. This can allow an attacker to execute arbitrary code in the current process when combined with other vulnerabilities. Affected component: ODAViewer/D...

CVE-2021-43273

CVE-2021-43273 concerns Open Design Alliance Drawings SDK (and related ODAViewer/Drawings Explorer) with an Out-of-bounds read/write in DGN file parsing. Exploitation arises from crafted DGN data and insufficient input validation, potentially allowing code execution in the attacker’s context (rem...

CVE-2021-43390: Out-of-bounds Write

An Out-of-Bounds Write vulnerability exists when reading a DGN file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DGN files. Crafted data in a DGN file and lack of proper validation of input data can trigger a write operation past the end ...

Open Design Alliance Drawings SDK 缓冲区错误漏洞

Open Design Alliance Drawings SDK is a software development kit for drawing design applications from Open Design Alliance, Inc. The development package provides access to data in .dwg and .dgn through a convenient, object-oriented API that provides a C API, support for repair files, support for t...

PT-2021-23800

Name of the Vulnerable Software and Affected Versions Open Design Alliance Drawings SDK versions prior to 2022.8 Description A stack-based buffer overflow vulnerability exists in the DWF file reading procedure due to the lack of proper validation of the length of user-supplied data before copying...

PT-2021-23826 · Open Design Alliance · Open Design Alliance Drawings Sdk

Name of the Vulnerable Software and Affected Versions: Open Design Alliance Drawings SDK versions prior to 2022.11 Description: The issue exists within the parsing of DXF files, where crafted data can trigger a read past the end of an allocated buffer, allowing an attacker to execute code in the...