CVE-2018-14524: Double Free
Published Jul 23, 2018
·Updated
dwgdecodeeed in decode.c in GNU LibreDWG before 0.6 leads to a double free (in dwgfreeeed in free.c) because it does not properly manage the obj->eed value after a free occurs.
Affected Software
1 affected component
GNU LibreDWG<0.6
Remediation
Patch Available
Event History
Jul 23, 2018
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-14524?
CVE-2018-14524 has a medium severity due to the potential for double free vulnerabilities that could lead to denial of service.
2
How do I fix CVE-2018-14524?
To fix CVE-2018-14524, upgrade to GNU LibreDWG version 0.6 or later.
3
What causes CVE-2018-14524?
CVE-2018-14524 is caused by improper management of the obj->eed value after freeing memory in the dwg_decode_eed function.
4
Who is affected by CVE-2018-14524?
Users with GNU LibreDWG versions prior to 0.6 are affected by CVE-2018-14524.
5
Is there a workaround for CVE-2018-14524 if I cannot upgrade?
There are no documented workarounds for CVE-2018-14524; upgrading to the patched version is recommended.