{"id":"CVE-2018-19105","aliases":["DEBIAN-CVE-2018-19105","DLA-1776-1","EUVD-2018-10820","GHSA-jfgr-wr44-g2mf","UBUNTU-CVE-2018-19105","USN-5957-1"],"status":"published","title":"LibreCAD 2.1.3 allows remote attackers to cause a denial of service (0x89C04589 write access...","description":"LibreCAD 2.1.3 allows remote attackers to cause a denial of service (0x89C04589 write access violation and application crash) or possibly have unspecified other impact via a crafted file.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01539,"percentile":0.75082,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2018-11-08T08:00:00Z","modified":"2026-10-24T10:30:42Z","fixes":[{"ecosystem":"Debian:12","package":"librecad","fixed_in":["2.1.3-1.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"librecad","fixed_in":["2.1.3-1.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"librecad","fixed_in":["2.1.3-1.2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"librecad","fixed_in":["2.0.4-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librecad","fixed_in":["2.0.9-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"librecad","fixed_in":["2.1.2-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librecad","fixed_in":["2.1.2-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1.2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-1+deb8u1"}]}],"versions":["2.0.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-2ubuntu0.1~esm1"}]}],"versions":["2.0.4-1build1","2.0.8-1","2.0.9-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1ubuntu0.1"}]}],"versions":["2.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1ubuntu0.1~esm1"}]}],"versions":["2.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-2ubuntu0.1~esm1"}]}],"versions":["2.0.4-1build1","2.0.8-1","2.0.9-2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1ubuntu0.1~esm1"}]}],"versions":["2.1.2-1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1.2+deb10u1build0.20.04.1"}]}],"versions":["2.1.3-1.2","2.1.3-1.2build1"],"bundled":7}],"products":[{"vendor":"librecad","product":"librecad"}],"references":[{"url":"https://code610.blogspot.com/2018/11/crashing-librecad-213.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00005.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19105"},{"url":"https://github.com/advisories/GHSA-jfgr-wr44-g2mf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-19105","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-19105","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5957-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-19105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21898","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21900","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-45341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-45342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-45343","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-19105","description":"LibreCAD 2.1.3 allows remote attackers to cause a denial of service (0x89C04589 write access violation and application crash) or possibly have unspecified other impact via a crafted file.","status":"published","published":"2018-11-08T08:00:00Z","modified":"2024-08-05T11:30:03.975Z","updated_at":"2026-11-02T14:35:03.288698Z"}],"euvd":[{"id":"EUVD-2018-10820","description":"LibreCAD 2.1.3 allows remote attackers to cause a denial of service (0x89C04589 write access violation and application crash) or possibly have unspecified other impact via a crafted file.","status":"published","published":"2018-11-08T08:00:00Z","modified":"2024-08-05T11:30:03Z","updated_at":"2026-11-03T02:39:34.247095Z"}],"ghsa":[{"id":"GHSA-jfgr-wr44-g2mf","title":"LibreCAD 2.1.3 allows remote attackers to cause a denial of service (0x89C04589 write access...","description":"LibreCAD 2.1.3 allows remote attackers to cause a denial of service (0x89C04589 write access violation and application crash) or possibly have unspecified other impact via a crafted file.","status":"published","published":"2022-05-14T01:05:47Z","modified":"2023-02-02T05:02:56Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:51:32.364862Z"}],"nvd":[{"id":"CVE-2018-19105","description":"LibreCAD 2.1.3 allows remote attackers to cause a denial of service (0x89C04589 write access violation and application crash) or possibly have unspecified other impact via a crafted file.","status":"published","published":"2018-11-08T08:29:00.337Z","modified":"2026-06-17T01:48:47.063Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:04:47.196456Z"}],"osv":[{"id":"CVE-2018-19105","description":"LibreCAD 2.1.3 allows remote attackers to cause a denial of service (0x89C04589 write access violation and application crash) or possibly have unspecified other impact via a crafted file.","status":"published","published":"2018-11-08T08:29:00.337Z","modified":"2026-10-24T10:30:42.134493085Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"DEBIAN-CVE-2018-19105","description":"LibreCAD 2.1.3 allows remote attackers to cause a denial of service (0x89C04589 write access violation and application crash) or possibly have unspecified other impact via a crafted file.","status":"published","published":"2018-11-08T08:29:00.337Z","modified":"2026-10-23T18:03:56.273156493Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"UBUNTU-CVE-2018-19105","description":"LibreCAD 2.1.3 allows remote attackers to cause a denial of service (0x89C04589 write access violation and application crash) or possibly have unspecified other impact via a crafted file.","status":"published","published":"2018-11-08T08:29:00Z","modified":"2026-02-04T03:45:27.649045Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"DLA-1776-1","title":"librecad - security update","status":"published","published":"2019-05-05T00:00:00Z","modified":"2026-03-09T01:22:03.418225Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"USN-5957-1","title":"librecad vulnerabilities","description":"Cody Sixteen discovered that LibreCAD incorrectly\nhandled memory when parsing DXF files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service. This issue only affected\nUbuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-19105)\n\nLilith of Cisco Talos discovered that LibreCAD incorrectly\nhandled memory when parsing DWG files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service, or possibly execute arbitrary code.\n(CVE-2021-21898, CVE-2021-21899)\n\nLilith of Cisco Talos discovered that LibreCAD incorrectly\nhandled memory when parsing DRW files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service, or possibly execute arbitrary code.\n(CVE-2021-21900)\n\nAlbin Eldstål-Ahrens discovered that LibreCAD incorrectly\nhandled memory when parsing JWW files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service, or possibly execute arbitrary code.\n(CVE-2021-45341, CVE-2021-45342)\n\nAlbin Eldstål-Ahrens discovered that LibreCAD incorrectly\nhandled memory when parsing DXF files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service. (CVE-2021-45343)\n","status":"published","published":"2023-03-15T16:20:03Z","modified":"2026-06-25T13:31:54.198205802Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}