CVE-2021-45343

NameCVE-2021-45343
DescriptionIn LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2908-1, DSA-5077-1
Debian Bugs1004518

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
librecad (PTS)bullseye (security), bullseye2.1.3-1.3+deb11u1fixed
bookworm2.2.0-1fixed
sid, trixie2.2.0.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
librecadsourcestretch2.1.2-1+deb9u3DLA-2908-1
librecadsourcebuster2.1.3-1.2+deb10u1DSA-5077-1
librecadsourcebullseye2.1.3-1.3+deb11u1DSA-5077-1
librecadsource(unstable)2.1.3-31004518

Notes

https://github.com/LibreCAD/LibreCAD/issues/1468
https://github.com/LibreCAD/LibreCAD/pull/1469
Fixed by: https://github.com/LibreCAD/LibreCAD/commit/5771425808bd16e78e1c6f28728c0712c47316f7
Search for package or bug name: Reporting problems