CVE-2022-0496: Buffer Overflow
A DXF-format drawing with particular (not necessarily malformed!) properties may cause an out-of-bounds memory access when imported using import().
References:
https://github.com/openscad/openscad/issues/4037
Other sources
A vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily malformed!) properties may cause an out-of-bounds memory access when imported using import().
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openscadto a version that resolves this vulnerability.Fixed in 2021.01-6Fixed in 2021.01-8Fixed in 2021.01-14 - Upgrade
Upgrade
alpine/openscadto a version that resolves this vulnerability.Fixed in 2021.01-r2 - Upgrade
Upgrade
debian/openscadto a version that resolves this vulnerability.Fixed in 2021.01-4
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-0496.
What is the title of the vulnerability?
The title of the vulnerability is 'A vulnerbiility was found in Openscad where a DXF-format drawing with particular (not necessarily malformed!) properties may cause an out-of-bounds memory access when imported using import()'.
What software is affected by the vulnerability?
Openscad software is affected by the vulnerability.
What is the severity of the vulnerability?
The severity of the vulnerability is medium, with a severity value of 5.5.
How can I fix the vulnerability?
To fix the vulnerability, update Openscad to the latest version released after February 4, 2022.