Update to 2.2.0 RC4. ---- Update librecad to 2.2.0 rc3. Apply fixes to libdxfrw and librecad for CVE-2021-45341, CVE-2021-45342, CVE-2021-45343. This also resolves the issue where some dwg files no longer opened.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-3dd3274ae2 2022-10-04 00:51:10.079438 --------------------------------------------------------------------------------Name : libdxfrw Product : Fedora 35 Version : 1.1.0 Release : 0.1.rc1.fc35 URL : https://github.com/LibreCAD/libdxfrw Summary : Library to read/write DXF files Description : libdxfrw is a free C++ library to read and write DXF files in both formats, ASCII and binary form. --------------------------------------------------------------------------------Update Information: Update to 2.2.0 RC4. ---- Update librecad to 2.2.0 rc3. Apply fixes to libdxfrw and librecad for CVE-2021-45341, CVE-2021-45342, CVE-2021-45343. This also resolves the issue where some dwg files no longer opened. --------------------------------------------------------------------------------ChangeLog: * Wed Sep 14 2022 Richard Shaw - 1.1.0-0.1.rc4 - Update to 1.1.0 RC1 per upstream recommendatation. * Thu Jul 21 2022 Fedora Release Engineering - 1.0.1-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild * Tue Feb 1 2022 Tom Callaway - 1.0.1-3 - apply fixes from upstream, including fix for CVE-2021-45343 * Thu Jan 20 2022 Fedora Release Engineering - 1.0.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #2027148 - librecad-2.2.0-rc3 is available https://bugzilla.redhat.com/show_bug.cgi?id=2027148 [ 2 ] Bug #2031379 - [regression] .dwg file no longer opens https://bugzilla.redhat.com/show_bug.cgi?id=2031379 [ 3 ] Bug #2046248 - CVE-2021-45341 librecad: bufferoverflow in CDataMoji of the jwwlib component allows remote code execution via a crafted JWW document [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2046248 [ 4 ] Bug #2046252 - CVE-2021-45342 librecad: buffer overflow in CDataList of the jwwlib component allows remote code execution via a crafted JWW document [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2046252 [ 5 ] Bug #2046256 - CVE-2021-45343 librecad: NULL pointer dereference in the HATCH handling of libdxfrw can lead to DoS via a crafted DXF document [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2046256 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-3dd3274ae2' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
A code execution vulnerability exists in the dwgCompressor::decompress18() functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2021-21898) . MGASA-2022-0151 - Updated libdxfrw packages fix security vulnerability Publication date: 24 Apr 2022 URL: https://advisories.mageia.org/MGASA-2022-0151.html Type: security Affected Mageia releases: 8 CVE: CVE-2021-21898, CVE-2021-21899, CVE-2021-21900, CVE-2021-45343 A code execution vulnerability exists in the dwgCompressor::decompress18() functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2021-21898) A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2021-21899) A code execution vulnerability exists in the dxfRW::processLType() functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dxf file can lead to a use-after-free vulnerability. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2021-21900) In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document. (CVE-2021-45343) References: - https://bugs.mageia.org/show_bug.cgi?id=29720 - https://lists.fedoraproject.org/archives/list/
An update that fixes three vulnerabilities is now available. . openSUSE Security Update: Security update for libdxfrw, librecad ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0067-1 Rating: important References: #1192936 #1192937 #1192938 Cross-References: CVE-2021-21898 CVE-2021-21899 CVE-2021-21900 CVSS scores: CVE-2021-21898 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21899 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21900 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libdxfrw, librecad fixes the following issues: - Update to version 1.0.1+git.20220109: * fixed ambiguous error for DRW_Dimension::parseDwg() * fixed enless while()-loop for pre 2004 versions * dwgReader::readDwgObjects() stop reading after 1st error * dwgReader::readDwgEntities() stop reading after 1st error * replace ENTRY_PARSE macro with template method * remove unused DRW_Class::parseCode() method * protect vector .reserve() calls * Added NULL check for hatch code 93 * Fix bounds check in DRW_LWPolyline * fix, check maxClassNum for valid value * fixed wrong 2010+ check for 64-bit size * Set compiler warnings on by default, because makes harder for bugs to go undetected. modified: CMakeLists.txt * Fixed fall through and other warnings (#54) * fix "Vertex ID" printout - Update to version 1.0.1+git.20211110: * fixed heap use after free vulnerability CVE-2021-21900 (boo#1192938) * minor improvements to dwg2dxf, formatting and message output on success * fixed heapbuffer overflow vulnerability CVE-2021-21899 (boo#1192937) * dwg2dxf - enable debug output of libdxfrw by command line switch * fixed out-of-bounds write vulnerability CVE-2021-21898 (boo#1192936) * fixed please note section formatting * updated README.md for LibreCAD_3 branch and sf.net successor * fixed LibreCAD 2 issue #1371, read failed with binary DXF * Use ununordered_map instead of map * manual merge changes from LibreCAD2 * and much more - Update to version 1.0.1+git.20200429: * Fix includes install dir * Export target as libdxfrw::libdxfrw to keep consistency with Conan packages * Add archive destination in install * Install DXFRW::dxfrw target * Remove duplicate target properties * Remove version from pkg-config file * Let CMake handle C++11 compiler definition * Change minimal required CMake version to 3.0 * cmake: add doc target * README.md: fix typo * cmake: generate and install pkgconfig * cmake: add one for dwg2dxf * cmake: set library VERSIONs * cmake: use GNUInstallDirs - Update to version 0.6.3+git.20190501: * Add build status and update example link * Add Travis-CI script * [#10] Fix compilation on GCC * Fix bugs with .dwg import of TEXT and MTEXT entities * This was unnecessary * Link libdxfrw against libstdc++ * Return an error when the file ends prematurely * Add version getter * Fix polyline 2d/3d write * Initialize return buffers in GetRawChar8 et al. - update to 2.2.0-rc3 * major release * DWG imports are more reliable now * and a lot more of bugfixes and improvements Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-67=1 Package List: -openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): libdxfrw-devel-1.0.1+git.20220109-bp153.2.3.1 libdxfrw-tools-1.0.1+git.20220109-bp153.2.3.1 libdxfrw1-1.0.1+git.20220109-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): librecad-2.2.0~rc3-bp153.2.3.1 librecad-debuginfo-2.2.0~rc3-bp153.2.3.1 librecad-debugsource-2.2.0~rc3-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (noarch): librecad-parts-2.2.0~rc3-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-21898.html https://www.suse.com/security/cve/CVE-2021-21899.html https://www.suse.com/security/cve/CVE-2021-21900.html https://bugzilla.suse.com/1192936 https://bugzilla.suse.com/1192937 https://bugzilla.suse.com/1192938 . This revision targets essential LibDXFRW and LibreCAD vulnerabilities, tackling various heap, buffer, and write risks.. LibDXFRW Patch, LibreCAD Security, openSUSE Update, Software Vulnerability, Security Fixes. . Severity: Important. LinuxSecurity.com Team
Update librecad to 2.2.0 rc3. Apply fixes to libdxfrw and librecad for CVE-2021-45341, CVE-2021-45342, CVE-2021-45343. This also resolves the issue where some dwg files no longer opened.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-08d7ee21f7 2022-02-12 01:14:11.929405 --------------------------------------------------------------------------------Name : libdxfrw Product : Fedora 34 Version : 1.0.1 Release : 3.fc34 URL : https://github.com/LibreCAD/libdxfrw Summary : Library to read/write DXF files Description : libdxfrw is a free C++ library to read and write DXF files in both formats, ASCII and binary form. --------------------------------------------------------------------------------Update Information: Update librecad to 2.2.0 rc3. Apply fixes to libdxfrw and librecad for CVE-2021-45341, CVE-2021-45342, CVE-2021-45343. This also resolves the issue where some dwg files no longer opened. --------------------------------------------------------------------------------ChangeLog: * Tue Feb 1 2022 Tom Callaway - 1.0.1-3 - apply fixes from upstream, including fix for CVE-2021-45343 * Thu Jan 20 2022 Fedora Release Engineering - 1.0.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #2027148 - librecad-2.2.0-rc3 is available https://bugzilla.redhat.com/show_bug.cgi?id=2027148 [ 2 ] Bug #2031379 - [regression] .dwg file no longer opens https://bugzilla.redhat.com/show_bug.cgi?id=2031379 [ 3 ] Bug #2046248 - CVE-2021-45341 librecad: buffer overflow in CDataMoji of the jwwlib component allows remote code execution via a crafted JWW document [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2046248 [ 4 ] Bug #2046252 - CVE-2021-45342 librecad: buffer overflow in CDataList of the jwwlib component allows remote codeexecution via a crafted JWW document [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2046252 [ 5 ] Bug #2046256 - CVE-2021-45343 librecad: NULL pointer dereference in the HATCH handling of libdxfrw can lead to DoS via a crafted DXF document [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2046256 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-08d7ee21f7' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Update libdxfrw to 1.0.1 (from upstream git). Rebuild librecad against it. This fixes CVE-2021-21898, CVE-2021-21899, and CVE-2021-21900.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-fa9e3c23f2 2021-12-01 01:19:37.797801 --------------------------------------------------------------------------------Name : libdxfrw Product : Fedora 35 Version : 1.0.1 Release : 1.fc35 URL : https://github.com/LibreCAD/libdxfrw Summary : Library to read/write DXF files Description : libdxfrw is a free C++ library to read and write DXF files in both formats, ASCII and binary form. --------------------------------------------------------------------------------Update Information: Update libdxfrw to 1.0.1 (from upstream git). Rebuild librecad against it. This fixes CVE-2021-21898, CVE-2021-21899, and CVE-2021-21900. --------------------------------------------------------------------------------ChangeLog: * Mon Nov 22 2021 Tom Callaway - 1.0.1-1 - rebase to new code home, fixes CVE-2021-21898/21899/21900 --------------------------------------------------------------------------------References: [ 1 ] Bug #2025628 - CVE-2021-21899 librecad: heap out-of-bounds write in dwgCompressor:copyCompBytes21 https://bugzilla.redhat.com/show_bug.cgi?id=2025628 [ 2 ] Bug #2025631 - CVE-2021-21900 librecad: use-after-free in dxfRW:processLType() https://bugzilla.redhat.com/show_bug.cgi?id=2025631 [ 3 ] Bug #2025634 - CVE-2021-21898 librecad: out-of-bounds write in dwgCompressor:decompress18() https://bugzilla.redhat.com/show_bug.cgi?id=2025634 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-fa9e3c23f2' at the command line. For more information, refer to the dnf documentation availableat https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Update libdxfrw to 1.0.1 (from upstream git). Rebuild librecad against it. This fixes CVE-2021-21898, CVE-2021-21899, and CVE-2021-21900.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-67c946a9f3 2021-12-01 01:12:49.872874 --------------------------------------------------------------------------------Name : libdxfrw Product : Fedora 34 Version : 1.0.1 Release : 1.fc34 URL : https://github.com/LibreCAD/libdxfrw Summary : Library to read/write DXF files Description : libdxfrw is a free C++ library to read and write DXF files in both formats, ASCII and binary form. --------------------------------------------------------------------------------Update Information: Update libdxfrw to 1.0.1 (from upstream git). Rebuild librecad against it. This fixes CVE-2021-21898, CVE-2021-21899, and CVE-2021-21900. --------------------------------------------------------------------------------ChangeLog: * Mon Nov 22 2021 Tom Callaway - 1.0.1-1 - rebase to new code home, fixes CVE-2021-21898/21899/21900 * Thu Jul 22 2021 Fedora Release Engineering - 0.6.3-19 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild * Thu May 27 2021 Tom Callaway - 0.6.3-18 - disable rpath --------------------------------------------------------------------------------References: [ 1 ] Bug #2025628 - CVE-2021-21899 librecad: heap out-of-bounds write in dwgCompressor:copyCompBytes21 https://bugzilla.redhat.com/show_bug.cgi?id=2025628 [ 2 ] Bug #2025631 - CVE-2021-21900 librecad: use-after-free in dxfRW:processLType() https://bugzilla.redhat.com/show_bug.cgi?id=2025631 [ 3 ] Bug #2025634 - CVE-2021-21898 librecad: out-of-bounds write in dwgCompressor:decompress18() https://bugzilla.redhat.com/show_bug.cgi?id=2025634 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c'dnf upgrade --advisory FEDORA-2021-67c946a9f3' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Get the latest Linux and open source security news straight to your inbox.