libredwg-devel-0.11.1-1.6 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:10981 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z libredwg-devel-0.11.1-1.6 on GA media These are all security issues fixed in the libredwg-devel-0.11.1-1.6 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-10981 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:10981 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2018-14471/ SUSE CVE CVE-2018-14471 page https://www.suse.com/security/cve/CVE-2018-14524/ SUSE CVE CVE-2018-14524 page https://www.suse.com/security/cve/CVE-2019-20009/ SUSE CVE CVE-2019-20009 page https://www.suse.com/security/cve/CVE-2019-20010/ SUSE CVE CVE-2019-20010 page https://www.suse.com/security/cve/CVE-2019-20012/ SUSE CVE CVE-2019-20012 page https://www.suse.com/security/cve/CVE-2019-20014/ SUSE CVE CVE-2019-20014 page https://www.suse.com/security/cve/CVE-2019-9770/ SUSE CVE CVE-2019-9770 page https://www.suse.com/security/cve/CVE-2019-9771/ SUSE CVE CVE-2019-9771 page https://www.suse.com/security/cve/CVE-2019-9772/ SUSE CVE CVE-2019-9772 page https://www.suse.com/security/cve/CVE-2019-9773/ SUSE CVE CVE-2019-9773 page https://www.suse.com/security/cve/CVE-2019-9774/ SUSE CVE CVE-2019-9774 page https://www.suse.com/security/cve/CVE-2019-9775/ SUSE CVE CVE-2019-9775 page https://www.suse.com/security/cve/CVE-2019-9776/ SUSE CVE CVE-2019-9776 page https://www.suse.com/security/cve/CVE-2019-9777/ SUSE CVE CVE-2019-9777 page https://www.suse.com/security/cve/CVE-2019-9778/ SUSE CVE CVE-2019-9778 page https://www.suse.com/security/cve/CVE-2019-9779/ SUSE CVE CVE-2019-9779 page https://www.suse.com/security/cve/CVE-2020-6609/ SUSE CVE CVE-2020-6609 page https://www.suse.com/security/cve/CVE-2020-6611/ SUSE CVE CVE-2020-6611 page https://www.suse.com/security/cve/CVE-2020-6613/ SUSE CVE CVE-2020-6613 page https://www.suse.com/security/cve/CVE-2020-6615/ SUSE CVE CVE-2020-6615 page openSUSE Tumbleweed libredwg-devel-0.11.1-1.6 libredwg-tools-0.11.1-1.6 libredwg0-0.11.1-1.6 libredwg-devel-0.11.1-1.6 as a component of openSUSE Tumbleweed libredwg-tools-0.11.1-1.6 as a component of openSUSE Tumbleweed libredwg0-0.11.1-1.6 as a component of openSUSE Tumbleweed dwg_obj_block_control_get_block_headers in dwg_api.c in GNU LibreDWG 0.5.1048 allows remote attackers to cause a denial of service (NULL pointer dereference and SEGV) via a crafted dwg file. CVE-2018-14471 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14471.html CVE-2018-14471 https://bugzilla.suse.com/1102696 SUSE Bug 1102696 dwg_decode_eed in decode.c in GNU LibreDWG before 0.6 leads to a double free (in dwg_free_eed in free.c) because it does not properly manage the obj->eed value after a free occurs. CVE-2018-14524 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14524.html CVE-2018-14524 https://bugzilla.suse.com/1102702 SUSE Bug 1102702 An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_SPLINE_private in dwg.spec. CVE-2019-20009 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-20009.html CVE-2019-20009 https://bugzilla.suse.com/1159824 SUSE Bug 1159824 An issue was discovered in GNU LibreDWG 0.92. There is a use-after-free in resolve_objectref_vector in decode.c. CVE-2019-20010 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-20010.html CVE-2019-20010 https://bugzilla.suse.com/1159825 SUSE Bug 1159825 An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_HATCH_private in dwg.spec. CVE-2019-20012 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-20012.html CVE-2019-20012 https://bugzilla.suse.com/1159827 SUSE Bug 1159827 An issue was discovered in GNU LibreDWG before 0.93. There is a double-free in dwg_free in free.c. CVE-2019-20014 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-20014.html CVE-2019-20014 https://bugzilla.suse.com/1159831 SUSE Bug 1159831 An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer overflow in the function dwg_decode_eed_data at decode.c for the y dimension. CVE-2019-9770 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-9770.html CVE-2019-9770 https://bugzilla.suse.com/1129881 SUSE Bug 1129881 An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a NULL pointer dereference in the function bit_convert_TU at bits.c. CVE-2019-9771 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-9771.html CVE-2019-9771 https://bugzilla.suse.com/1129876 SUSE Bug 1129876 An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a NULL pointer dereference in the function dwg_dxf_LEADER at dwg.spec. CVE-2019-9772 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-9772.html CVE-2019-9772 https://bugzilla.suse.com/1129875 SUSE Bug 1129875 An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer overflow in the function dwg_decode_eed_data at decode.c for the z dimension. CVE-2019-9773 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-9773.html CVE-2019-9773 https://bugzilla.suse.com/1129874 SUSE Bug 1129874 An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is an out-of-bounds read in the function bit_read_B at bits.c. CVE-2019-9774 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-9774.html CVE-2019-9774 https://bugzilla.suse.com/1129879 SUSE Bug 1129879 An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is an out-of-bounds read in the function dwg_dxf_BLOCK_CONTROL at dwg.spec. CVE-2019-9775 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-9775.html CVE-2019-9775 https://bugzilla.suse.com/1129878 SUSE Bug 1129878 An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a NULL pointer dereference in the function dwg_dxf_LTYPE at dwg.spec (later than CVE-2019-9779). CVE-2019-9776 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-9776.html CVE-2019-9776 https://bugzilla.suse.com/1129868 SUSE Bug 1129868 https://bugzilla.suse.com/1129873 SUSE Bug 1129873 An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer over-read in the function dxf_header_write at header_variables_dxf.spec. CVE-2019-9777 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-9777.html CVE-2019-9777 https://bugzilla.suse.com/1129870 SUSE Bug 1129870 An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer over-read in the function dwg_dxf_LTYPE at dwg.spec. CVE-2019-9778 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-9778.html CVE-2019-9778 https://bugzilla.suse.com/1129869 SUSE Bug 1129869 An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a NULL pointer dereference in the function dwg_dxf_LTYPE at dwg.spec (earlier than CVE-2019-9776). CVE-2019-9779 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-9779.html CVE-2019-9779 https://bugzilla.suse.com/1129868 SUSE Bug 1129868 https://bugzilla.suse.com/1129873 SUSE Bug 1129873 GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in read_pages_map in decode_r2007.c. CVE-2020-6609 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-6609.html CVE-2020-6609 https://bugzilla.suse.com/1160520 SUSE Bug 1160520 GNU LibreDWG 0.9.3.2564 has a NULL pointer dereference in get_next_owned_entity in dwg.c. CVE-2020-6611 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-6611.html CVE-2020-6611 https://bugzilla.suse.com/1160523 SUSE Bug 1160523 GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bit_search_sentinel in bits.c. CVE-2020-6613 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-6613.html CVE-2020-6613 https://bugzilla.suse.com/1160525 SUSE Bug 1160525 GNU LibreDWG 0.9.3.2564 has an invalid pointer dereference in dwg_dynapi_entity_value in dynapi.c (dynapi.c is generated by gen-dynapi.pl). CVE-2020-6615 openSUSE Tumbleweed:libredwg-devel-0.11.1-1.6 openSUSE Tumbleweed:libredwg-tools-0.11.1-1.6 openSUSE Tumbleweed:libredwg0-0.11.1-1.6 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-6615.html CVE-2020-6615 https://bugzilla.suse.com/1160527 SUSE Bug 1160527