CVE-2021-45341

NameCVE-2021-45341
DescriptionA buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2908-1, DSA-5077-1
Debian Bugs1004518

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
librecad (PTS)bullseye (security), bullseye2.1.3-1.3+deb11u1fixed
bookworm2.2.0-1fixed
sid, trixie2.2.0.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
librecadsourcestretch2.1.2-1+deb9u3DLA-2908-1
librecadsourcebuster2.1.3-1.2+deb10u1DSA-5077-1
librecadsourcebullseye2.1.3-1.3+deb11u1DSA-5077-1
librecadsource(unstable)2.1.3-31004518

Notes

https://github.com/LibreCAD/LibreCAD/issues/1462
https://github.com/LibreCAD/LibreCAD/pull/1463
Fixed by: https://github.com/LibreCAD/LibreCAD/commit/f3502963eaf379a429bc9da73c1224c5db649997
Search for package or bug name: Reporting problems