SB2020012328 - OpenSUSE Linux update for libredwg
Published: January 23, 2020 Updated: January 31, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 17 secuirty vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2019-20009)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in "dwg_decode_SPLINE_private" in "dwg.spec". A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
2) Use-after-free (CVE-ID: CVE-2019-20010)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in "resolve_objectref_vector" in "decode.c". A remote attacker can trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
3) Out-of-bounds read (CVE-ID: CVE-2019-20011)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition in decode_R13_R2000 in decode.c. A remote attacker can trigger out-of-bounds read error and cause a denial of service contrition on the target system.
4) Resource exhaustion (CVE-ID: CVE-2019-20012)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in "dwg_decode_HATCH_private" in "dwg.spec". A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
5) Resource exhaustion (CVE-ID: CVE-2019-20013)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in "decode_3dsolid" in "dwg.spec". A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
6) Double Free (CVE-ID: CVE-2019-20014)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in "dwg_free" in "free.c". A remote attacker can trigger double free error and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
7) Resource exhaustion (CVE-ID: CVE-2019-20015)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in "dwg_decode_LWPOLYLINE_private" in "dwg.spec". A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
8) Buffer overflow (CVE-ID: CVE-2019-9770)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer overflow in the function dwg_decode_eed_data at decode.c for the y dimension.
9) NULL pointer dereference (CVE-ID: CVE-2019-9771)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dreference error in function bit_convert_TU at bits.c. A remote attacker can perform a denial of service (DoS) attack.
10) NULL pointer dereference (CVE-ID: CVE-2019-9772)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dreference error in function dwg_dxf_LEADER at dwg.spec. A remote attacker can perform a denial of service (DoS) attack.
11) Buffer overflow (CVE-ID: CVE-2019-9773)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer overflow in the function dwg_decode_eed_data at decode.c for the z dimension.
12) Out-of-bounds read (CVE-ID: CVE-2019-9774)
The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is an out-of-bounds read in the function bit_read_B at bits.c.
13) Out-of-bounds read (CVE-ID: CVE-2019-9775)
The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.
An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is an out-of-bounds read in the function dwg_dxf_BLOCK_CONTROL at dwg.spec.
14) NULL pointer dereference (CVE-ID: CVE-2019-9776)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dreference error in function dwg_dxf_LTYPE at dwg.spec (later than CVE-2019-9779). A remote attacker can perform a denial of service (DoS) attack.
15) Out-of-bounds read (CVE-ID: CVE-2019-9777)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to heap-based buffer over-read in the function dxf_header_write at header_variables_dxf.spec. A remote attacker can perform a denial of service attack.
16) Out-of-bounds read (CVE-ID: CVE-2019-9778)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to heap-based buffer over-read in the function dwg_dxf_LTYPE at dwg.spec. A remote attacker can perform a denial of service attack.
17) NULL pointer dereference (CVE-ID: CVE-2019-9779)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dreference error in function dwg_dxf_LTYPE at dwg.spec (earlier than CVE-2019-9776). A remote attacker can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.