OSV-2022-656

    Dashboard / Vulnerabilities / OSV-2022-656

    OSV-2022-656

    Published: 31 Jul 2022Last Modified: 10 Dec 2022

    Summary: Heap-buffer-overflow in dwg_decode_LWPOLYLINE_private

    Details: OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49630 ``` Crash type: Heap-buffer-overflow READ 1 Crash state: dwg_decode_LWPOLYLINE_private dwg_decode_LWPOLYLINE dwg_decode_add_object ```

    References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49630

    Affected packages

    Package

    Name: libredwg

    Purl: pkg:generic/libredwg

    Affected ranges

    Type: GIT

    Events:

    Introduced- 7a44f5e43b2a49bf244e24b796a657c9c78f31a1
    Fixed -9d068534eb093790d9be1b8aa8ed47cafc7f2285

    Affected versions

    0.12.4.4635
    0.12.4.4637
    0.12.4.4641
    0.12.4.4643
    0.12.4.4647
    0.12.4.4652
    0.12.4.4654
    0.12.4.4658
    0.12.4.4660
    0.12.4.4668
    0.12.5.4669
    0.12.5.4678

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    OSV-2022-656 | CVE-DB