CVE-2021-45342

NameCVE-2021-45342
DescriptionA buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2908-1, DSA-5077-1
Debian Bugs1004518

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
librecad (PTS)bullseye (security), bullseye2.1.3-1.3+deb11u1fixed
bookworm2.2.0-1fixed
sid, trixie2.2.0.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
librecadsourcestretch2.1.2-1+deb9u3DLA-2908-1
librecadsourcebuster2.1.3-1.2+deb10u1DSA-5077-1
librecadsourcebullseye2.1.3-1.3+deb11u1DSA-5077-1
librecadsource(unstable)2.1.3-31004518

Notes

https://github.com/LibreCAD/LibreCAD/issues/1464
https://github.com/LibreCAD/LibreCAD/pull/1465
Fixed by: https://github.com/LibreCAD/LibreCAD/commit/4edcbe72679f95cb60979c77a348c1522a20b0f4
Search for package or bug name: Reporting problems