CVE-2022-28808

Open Design Alliance Drawings SDK (Open Design Alliance) contains CVE-2022-28808, an out-of-bounds read when reading DWG files in recovery mode in all versions prior to 2023.3. The issue can allow code execution in the current process when processing DWG data in recovery mode. Affected component:...

CVE-2021-32950

CVE-2021-32950 concerns the Open Design Alliance Drawings SDK DXF parsing. The issue is an out-of-bounds read when processing DXF files in all versions before 2022.4, caused by insufficient validation of untrusted input. This can lead to reading beyond an allocated buffer and may enable denial-of...

CVE-2021-32940

CVE-2021-32940 is an out-of-bounds read in the Open Design Alliance Drawings SDK DWG file-recovering procedure, affecting all versions prior to 2022.5. The issue stems from improper validation of user-supplied data and can cause a read past the end of an allocated buffer, enabling denial-of-servi...

CVE-2021-32948

CVE-2021-32948 describes an out-of-bounds write in the DWG file-reading procedure of the Open Design Alliance Drawings SDK (prior to 2022.4), caused by insufficient validation of user-supplied data. This can write past the end of an allocated buffer and may lead to denial of service or code execu...

CVE-2021-32936

CVE-2021-32936 is an out-of-bounds write in the Open Design Alliance Drawings SDK (prior to 2022.4) during parsing of DXF files, caused by insufficient validation of user-supplied data. This can write past the end of an allocated buffer, enabling denial-of-service or arbitrary code execution in t...

CVE-2021-32944

Summary: CVE-2021-32944 is a use-after-free vulnerability in the Open Design Alliance Drawings SDK (DGN file-reading path) affecting all versions prior to 2022.4, caused by insufficient validation of user-supplied data, leading to memory corruption and potential code execution or DoS. The issue i...

CVE-2022-28807

CVE-2022-28807 affects the Open Design Alliance Drawings SDK (all versions prior to 2023.2). The issue is an out-of-bounds read when rendering DWG files after opening in recovery mode, which can allow code execution in the current process. The CVSSv3 base score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H...

CVE-2021-32938

CVE-2021-32938 affects the Open Design Alliance Drawings SDK (prior to 2022.4). The vulnerability is an out-of-bounds read when parsing DWG files, caused by insufficient validation of user-supplied data. This can lead to reading past the end of an allocated buffer and may enable denial-of-service...

CVE-2021-31784

CVE-2021-31784 describes an out-of-bounds write in Open Design Alliance Drawings SDK prior to 2021.6 during file parsing (DXF/DGN). The issue can crash the process or enable code execution in the context of the current process, with some sources noting potential remote code execution when process...

CVE-2021-32946

CVE-2021-32946 affects Siemens/Open Design Alliance Drawings SDK parsing of DGN files (Versions 2022.4 and earlier). Root cause: improper validation of user-supplied data in the Drawings SDK parsing path, leading to out-of-bounds conditions that may cause denial-of-service or code execution in th...

CVE-2023-5180

CVE-2023-5180 affects the Open Design Alliance Drawings SDK prior to 2024.12. A crafted DGN file can trigger an out-of-bounds write by corrupting the value of the number of sectors in the Fat structure, enabling code execution in the current process. The connected sources (e.g., PT-2023-31894, CI...

CVE-2023-26495

Open Design Alliance Drawings SDK (before 2024.1) is affected by a use-after-free vulnerability in DWG parsing. A crafted DWG file can trigger use-after-free, enabling an attacker to execute arbitrary code in the context of the current process, potentially in conjunction with other vulnerabilitie...

CVE-2021-32952

The CVE-2021-32952 entry concerns the Open Design Alliance Drawings SDK (DGN file-reading procedure) with versions up to 2022.4. Root cause: an out-of-bounds write due to insufficient validation of user-supplied data, enabling a write past the end of an allocated buffer. Impact: denial-of-service...

CVE-2023-22669

Open Design Alliance Drawings SDK (ODA) is affected by CVE-2023-22669 in versions prior to 2023.6, with a heap-based buffer overflow in DWG parsing that could allow code execution in the context of the current process. The issue is documented with CVSS v3.1 base score 7.8 (HIGH). Mitigation: upgr...

CVE-2021-43582

CVE-2021-43582 is an Use-After-Free vulnerability in the Open Design Alliance Drawings SDK (and related ODA tools) related to DWG file parsing prior to 2022.11. The issue arises from not validating an object's existence before performing operations, enabling an attacker to execute code in the cur...

CVE-2021-44045

Open Design Alliance Drawings SDK (ODA) prior to 2022.11 is affected. The issue lies in DGN file parsing where crafted data and a lack of validation for XFAT sectors count trigger an out-of-bounds write past an allocated buffer, allowing code execution in the current process. Related advisories (...

CVE-2018-18224

CVE-2018-18224 affects Open Design Alliance Drawings SDK 2019Update1 on non-Windows platforms, enabling reading past/before buffer boundaries and potential information leakage or crashes. Connected IBM docs tie this to Rational DOORS Next Generation versions and provide a remediation: upgrade Rat...

CVE-2022-28809

Open Design Alliance Drawings SDK (Open Design Alliance) contains an out-of-bounds read vulnerability in DWG handling for versions prior to 2023.3, specifically when reading a DWG with an invalid vertex number in recovery mode. The issue can allow code execution in the process context. Affected C...

CVE-2023-22670

CVE-2023-22670 is a heap-based buffer overflow in Open Design Alliance Drawings SDK prior to 2023.6, caused by insufficient validation of the length of user-supplied XRecord data before copying to a fixed-length heap buffer in the DXF file parsing path. The vulnerability allows code execution in ...

CVE-2021-44047

CVE-2021-44047 concerns the Open Design Alliance Drawings SDK. The issue is a use-after-free in the DWG/DWF/DWFX parsing path that can trigger a write past the end of an allocated buffer when processing crafted DWF/DWFX data. Affected component: ODA Drawings SDK’s file parsers. Impact: remote/cod...

CVE-2018-18223

The CVE-2018-18223 entry affects Open Design Alliance Drawings SDK 2019Update1, with a vulnerability during reading of malformed files that can disclose sensitive information from process memory or cause a crash. The connected sources provide concrete details (affected component and impact) but d...

CVE-2021-44044

CVE-2021-44044 affects Open Design Alliance Drawings SDK (and related Drawings Explorer) via an out-of-bounds write during JPG parsing. Crafting a JPG with 4 extraneous bytes before marker 0xCA can write past the end of an allocated buffer, enabling code execution in the current process. Several ...

CVE-2021-44422

CVE-2021-44422 concerns Open Design Alliance Drawings SDK/Drawings Explorer. The vulnerability arises from improper input validation during BMP parsing: lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. This can trigger a write past the end ...

CVE-2021-44859

The CVE applies to Open Design Alliance Drawings SDK (ODA Drawings Explorer) prior to version 2022.12, where parsing of TGA files is vulnerable. The issue is an out-of-bounds read caused by unchecked input data in crafted TGA files, as described across multiple sources (NVD entry and ZDI advisory...

CVE-2021-43273

CVE-2021-43273 concerns Open Design Alliance Drawings SDK (and related ODAViewer/Drawings Explorer) with an Out-of-bounds read/write in DGN file parsing. Exploitation arises from crafted DGN data and insufficient input validation, potentially allowing code execution in the attacker’s context (rem...

CVE-2021-44860

CVE-2021-44860 describes an out-of-bounds read in the Open Design Alliance Drawings SDK when parsing TIF files loaded after startup. The vulnerability stems from unchecked input data in crafted TIFs, allowing an attacker to execute code in the context of the current process. Affected component: O...

CVE-2023-5179

Open Design Alliance Drawings SDK (pre-2024.10) is affected by CVE-2023-5179. A crafted DGN file can corrupt the MiniFat sector start value, causing an out-of-bounds read. Consequences described include crash/denial-of-service and potential code execution. The description does not specify a confi...