CVE-2020-6613

CVE-2020-6613 affects GNU LibreDWG 0.9.3.2564 and is described as a heap-based over-read in bit_search_sentinel (bits.c). Connected entries show fixes in libredwg upstream to release 0.10 and security advisories (openSUSE/SUSE updates) that patch libredwg to mitigate CVE-2020-6613 (and related CV...

CVE-2019-20011

CVE-2019-20011 is a heap-based buffer over-read in GNU LibreDWG up to version 0.9.3 (decode_R13_R2000 in decode.c). OpenSUSE/SUSE advisories indicate this was addressed by releasing LibreDWG 0.9.3 with overflow checks and related fixes, and other documents corroborate the same vulnerability class...

CVE-2019-20014

CVE-2019-20014 (GNU LibreDWG) is a double-free in dwg_free() before 0.93. Public documents confirm the issue and list fixes in LibreDWG releases up to 0.9.3 (OpenSUSE/EU/Red Hat advisories), with remediation by upgrading to 0.9.3 or later. NVD reports CVSS v2: 6.8 (NETWORK, PARTIAL/partial impact...

CVE-2019-20010

CVE-2019-20010 affects GNU LibreDWG 0.92 with a use-after-free in resolve_objectref_vector (decode.c). Connected advisories show openSUSE/libredwg updates up to release 0.9.3 addressing this and related CVEs (e.g., 2019-20010, 2019-20011, 2019-20012, 2019-20013, 2019-20014, 2019-20015) across Ope...

CVE-2023-36274

LibreDWG vulnerability CVE-2023-36274 affects LibreDWG v0.11 through v0.12.5, caused by a heap buffer overflow in the bit_write_TF function (bits.c). Impact details in the sources indicate such overflow could lead to memory corruption. Public-fix references show OpenSUSE backport/update to 0.12.5...

CVE-2023-36272

CVE-2023-36272 affects LibreDWG (v0.10–v0.12.5); the root cause is a heap buffer overflow in the function bit_utf8_to_TU in bits.c. Impact is high (CVE 3.1 score 8.8) with potential in-network exploitation supposing no user interaction is required by the CVE advisory. Public materials in connecte...

CVE-2023-36271

CVE-2023-36271 affects LibreDWG, with a heap buffer overflow in the function bit_wcs2nlen implemented in bits.c, impacting versions from 0.10 up to 0.12.5 . The root cause is a memory safety issue in the bit_wcs2nlen routine that can overflow a heap buffer. Impact is described as a high-severity ...

CVE-2023-36273

CVE-2023-36273 affects LibreDWG in version 0.12.5, where a heap buffer overflow is triggered by the function bit_calc_CRC in bits.c. This is confirmed across multiple sources (NVD entry and OSS/openSUSE advisories) and is addressed by updating to LibreDWG v0.12.5.5907, which fixes the heap buffer...

CVE-2020-6609

GNU LibreDWG 0.9.3.2564 contains a heap-based buffer over-read in read_pages_map (decode_r2007.c), identified as CVE-2020-6609. Multiple connected advisories confirm this vulnerability and state that fixes were delivered in LibreDWG 0.10, with related CVEs 2020-6610 to 2020-6615 addressed in the ...

CVE-2020-6612

CVE-2020-6612 affects GNU LibreDWG, specifically version 0.9.3.2564, where a heap-based buffer over-read occurs in decode_r2007.c in copy_compressed_bytes. Public advisories from openSUSE/OpenSUSE security updates (libredwg 0.10) indicate this is among several fixes addressing CVEs in the 2020-66...

CVE-2020-6614

CVE-2020-6614 affects GNU LibreDWG 0.9.3.2564 with a heap-based buffer over-read in bfr_read (decode.c). Connected advisories show libredwg fixes in OpenSUSE/SUSE updates (0.10 release), addressing this and related CVEs (6609–6615). Affected: openSUSE Leap 15.1 and backports; remediation is upgra...

CVE-2020-21842

CVE-2020-21842 affects GNU LibreDWG 0.10 and is caused by a heap-based buffer overflow triggered in the function read_2004_section_revhistory (../../src/decode.c:3051). Public records in the connected feeds confirm this vulnerability and its presence in LibreDWG; additional entries from Red Hat, ...

CVE-2021-36080

CVE-2021-36080 affects GNU LibreDWG 0.12.3.4163 through 0.12.3.4191. The issue is a double-free in bit_chain_free , triggered by calls from dwg_encode_MTEXT and dwg_encode_add_object . Documented impact is memory management error; CVSS v2/3 metrics indicate high severity (base CVSSv3.1 8.8, NETWO...

CVE-2020-21844

CVE-2020-21844 affects GNU LibreDWG 0.10. The vulnerability is in memcpy-param-overlap in the read_2004_section_header function (../../src/decode.c:2580), exposing remote code execution. The connected records confirm the affected component and exact location, but do not provide further exploit sp...

CVE-2020-21831

The CVE refers to a heap-based buffer overflow in GNU LibreDWG 0.10 triggered by read_2004_section_handles (src/decode.c:2637). Affected component is the LibreDWG library used for reading DWG files. Based on CVSS data, the vulnerability is exploitable remotely with network access, and the impact ...

CVE-2020-21833

The CVE-2020-21833 entry affects GNU LibreDWG 0.10 and is caused by a heap-based buffer overflow in the decoder path, triggered via read_2004_section_classes at ../../src/decode.c:2440. The existing records consistently describe this vulnerability as a heap overflow in LibreDWG 0.10; no additiona...

CVE-2023-25222

The CVE-2023-25222 entry concerns GNU LibreDWG v0.12.5, where a heap-based buffer overflow is reported in the bit_read_RC function of bits.c. Several connected sources (Red Hat, SUSE, OSV, NVD, CVE List, CNNVD, etc.) corroborate a heap-based overflow in this exact component/version. Documented im...

CVE-2021-42586

CVE-2021-42586 affects GNU LibreDWG prior to 0.12.4, where a boundary/heap issue in decode_r2007.c: copy_bytes can trigger a heap buffer overflow when processing crafted DWG files. Several sources (SUSE, CNVD, NVD/NVD entry) confirm the vulnerability and version target. Impact is a heap overflow,...

CVE-2020-21843

The CVE-2020-21843 vulnerability affects GNU LibreDWG 0.10, caused by a heap-based buffer overflow in bit_read_RC (bits.c:318). It is described across multiple sources as a heap overflow via a specific read path. The documents do not provide confirmed patches or a remediation version; no exploit ...

CVE-2021-39525

Summary: CVE-2021-39525 affects libredwg up to v0.10.1.3751, where bit_read_fixed() in bits.c has a heap-based buffer overflow. The vulnerability is documented with CVSS v3.1 score 8.8 (HIGH) and CVSS v2.0 score 6.8 (MEDIUM) indicating network access, no authentication, and partial impact on conf...

CVE-2020-21832

CVE-2020-21832 describes a heap-based buffer overflow in GNU LibreDWG 0.10, triggered by reading in the function read_2004_compressed_section (src/decode.c:2417). The vulnerability affects LibreDWG’s ability to safely process certain DWG inputs, with potential impacts on confidentiality, integrit...

CVE-2020-21838

CVE-2020-21838 affects GNU LibreDWG 0.10 and is a heap-based buffer overflow triggered by read_2004_section_appinfo in ../../src/decode.c:2842. The vulnerability is documented across multiple sources (NVD, Red Hat, SUSE, CNVD/CNVD-like entries, OSV, etc.). Reported impact indicates potential part...

CVE-2020-21840

The connected records confirm a heap-based buffer overflow in GNU LibreDWG 0.10, exploitable via bit_search_sentinel in ../../src/bits.c:1985. Affected component: LibreDWG library (C, DWG reading/writing). Root cause: buffer overflow in heap handling. Impact as stated: Confidentiality/Integrity/A...

CVE-2021-42585

The CVE-2021-42585 entry concerns GNU LibreDWG (a C library for processing DWG files). A heap buffer overflow was reported in copy_compressed_bytes within decode_r2007.c when processing untrusted input, affecting LibreDWG versions prior to 0.12.4 and triggered by crafted DWG files. Root cause ide...

CVE-2020-21830

Affects GNU LibreDWG 0.10. A heap-based buffer overflow via bit_calc_CRC in ../../src/bits.c:2213 is reported across multiple sources (CVE records, CNVD, CNNVD, SUSE, Red Hat). The vulnerability is described consistently as a heap overflow in LibreDWG’s handling of DWG data, with cited location b...

CVE-2020-21836

The CVE-2020-21836 entry is confirmed with concrete details across connected documents: a heap-based buffer overflow in GNU LibreDWG 0.10 triggered via read_2004_section_preview in ../../src/decode.c:3175. Documents consistently describe LibreDWG as the impacted library for DWG file handling, wit...

CVE-2020-21841

CVE-2020-21841 affects GNU LibreDWG 0.10. The vulnerability is a heap-based buffer overflow triggered by a flaw in bit_read_B in ../../src/bits.c:135. Multiple connected records (Red Hat, SUSE, CNVD, NVD, NVD-derived feeds, and others) confirm the same issue across sources, indicating a consisten...

CVE-2019-20913

CVE-2019-20913 affects GNU LibreDWG up to version 0.9.3. The issue is a heap-based buffer over-read in the function dwg_encode_entity within common_entity_data.spec, triggered by crafted input. Impact is described as a heap-based over-read; no additional exploit details or remediation are provide...

CVE-2019-20915

CVE-2019-20915 affects GNU LibreDWG up to version 0.9.3. A crafted input triggers a heap-based buffer over-read in bit_write_TF within bits.c, as described across multiple connected documents. Impact details in sources vary, but CVSS data from NVD indicates high impact under network attack with p...

CVE-2021-39522

CVE-2021-39522 affects the LibreDWG library (libredwg) up to version 0.10.1.3751. The root cause is a heap-based buffer overflow in bit_wcs2len() located in bits.c. This vulnerability can potentially corrupt heap memory when processing certain inputs, as described in multiple sources (e.g., CNVD-...

CVE-2021-39530

CVE-2021-39530 affects the LibreDWG project (libredwg) up to version 0.10.1.3751. The issue is a heap-based buffer overflow in bit_wcs2nlen() implemented in bits.c. The available documents confirm this as a vulnerability in LibreDWG with a reported CVSS base score of 8.8 (3.1) indicating high imp...

CVE-2020-21816

CVE-2020-21816 is a reported heap-based buffer overflow in GNU LibreDWG 0.10.2641. The root cause is described as a heap buffer overflow in the escape routine used for HTML escaping (htmlescape) in ../../programs/escape.c:46. This vulnerability is documented across multiple sources (NVD, CNVD, Re...

CVE-2019-20912

CVE-2019-20912 affects GNU LibreDWG up to version 0.9.3. The issue is a vulnerability in bits.c where crafted input can trigger a stack overflow, potentially related to bit_read_TF. Multiple connected sources reiter this description, indicating a stack overflow in memory operations caused by malf...

CVE-2020-21819

GNU LibreDWG 0.10.2641 contains a heap-based buffer overflow vulnerability exploitable via the code path in htmlescape ../../programs/escape.c:51. Affected component is the LibreDWG C library used for DWG file handling. Impact is described as heap corruption with potential high impact to confiden...

CVE-2021-39528

CVE-2021-39528 is a confirmed vulnerability in the LibreDWG library. The issue is a double-free in dwg_free_MATERIAL_private() within dwg.spec, affecting libredwg up to version 0.10.1.3751. Documented risk metrics indicate a high impact with network attack vector and both confidentiality/ integri...

CVE-2021-39527

CVE-2021-39527 describes a heap-based buffer overflow in LibreDWG/libredwg (up to v0.10.1.3751). The root cause is in decode.c, function appinfo_private() . Reported impact per records: CVSSv3.1 base score 8.8 (HIGH) with network attack, no authentication, UI required, and impact on confidentiali...

CVE-2020-21814

CVE-2020-21814 describes a heap-based buffer overflow in GNU LibreDWG 0.10.2641 triggered via htmlwescape ../../programs/escape.c:97. The connected documents consistently identify the affected component as LibreDWG and the vulnerable code path in escape.c, but none provide a concrete patch/versio...

CVE-2019-20910

GNU LibreDWG up to version 0.9.3 is affected by CVE-2019-20910 due to a heap-based buffer over-read in decode_R13_R2000 within decode.c. This is observed in the CVE-2019-20910 entries across NVD/CNVD/OSV and related advisories (e.g., OpenSUSE security update for libredwg). The vulnerability stems...

CVE-2020-21818

GNU LibreDWG 0.10.2641 contains a heap-based buffer overflow in the function used for HTML escaping (htmlescape) at line 48 in escape.c. The vulnerability is documented across multiple sources (CVE-2020-21818 entries) and explicitly identifies the affected version and vulnerable code path. The co...