{"id":"CVE-2021-45341","aliases":["DEBIAN-CVE-2021-45341","DLA-2908-1","DSA-5077-1","EUVD-2021-32114","GHSA-9882-476q-39vf","MGASA-2022-0152","UBUNTU-CVE-2021-45341","USN-5957-1","openSUSE-SU-2022:0143-1","openSUSE-SU-2022:10002-1","openSUSE-SU-2024:12082-1"],"status":"published","title":"A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and...","description":"A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.06617,"percentile":0.93905,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2022-01-25T00:00:00Z","modified":"2026-10-23T18:04:17Z","fixes":[{"ecosystem":"Debian:12","package":"librecad","fixed_in":["2.1.3-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"librecad","fixed_in":["2.1.3-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"librecad","fixed_in":["2.1.3-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librecad","fixed_in":["2.0.9-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"librecad","fixed_in":["2.1.2-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librecad","fixed_in":["2.1.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"librecad","fixed_in":["2.1.3-1.2+deb10u1build0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"librecad","fixed_in":["2.1.3-3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-3"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1+deb9u3"}]}],"versions":["2.1.2-1","2.1.2-1+deb9u1","2.1.2-1+deb9u2"],"bundled":3},{"source":"osv","ecosystem":"Debian:10","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1.2+deb10u1"}]}],"versions":["2.1.3-1.2"],"bundled":6},{"source":"osv","ecosystem":"Debian:11","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1.3+deb11u1"}]}],"versions":["2.1.3-1.3"],"bundled":6},{"source":"osv","ecosystem":"Mageia:8","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-0.rc3.1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-2ubuntu0.1~esm1"}]}],"versions":["2.0.4-1build1","2.0.8-1","2.0.9-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1ubuntu0.1"}]}],"versions":["2.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1ubuntu0.1~esm1"}]}],"versions":["2.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1.2+deb10u1build0.20.04.1"}]}],"versions":["2.1.3-1.2","2.1.3-1.2build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-3"}]}],"versions":["2.1.3-1.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-2ubuntu0.1~esm1"}]}],"versions":["2.0.4-1build1","2.0.8-1","2.0.9-2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1ubuntu0.1~esm1"}]}],"versions":["2.1.2-1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1.2+deb10u1build0.20.04.1"}]}],"versions":["2.1.3-1.2","2.1.3-1.2build1"],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0~rc3-bp153.2.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0~rc3-bp153.2.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"libdxfrw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1+git.20220109-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0~rc3-bp154.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libdxfrw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1+git.20220109-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0~rc3-bp154.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0~rc3-7.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"librecad","product":"librecad"}],"references":[{"url":"https://github.com/LibreCAD/LibreCAD/issues/1462","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUMH3CWGVSMR2UIZEA35Q5UB7PDVVVYS/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://www.debian.org/security/2022/dsa-5077","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCC2FZ6HZOIK3775K4MTCOUHX6PLGPEL/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202305-26","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45341"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUMH3CWGVSMR2UIZEA35Q5UB7PDVVVYS/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FCC2FZ6HZOIK3775K4MTCOUHX6PLGPEL/"},{"url":"https://github.com/advisories/GHSA-9882-476q-39vf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-45341","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0152.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29996","tags":["report"]},{"url":"https://www.debian.org/lts/security/2022/dla-2908","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/MBLTKH2Q6OBOLSNHIKPW74SFFSC5A2BB/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-45341","tags":["report"]},{"url":"https://github.com/LibreCAD/LibreCAD/pull/1463","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5957-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21898","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21900","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-45342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-45343","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/H67WLPQ3LF4GRKIXDOTJFA2DT732SNIG/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1195105","tags":["report"]},{"url":"https://bugzilla.suse.com/1195122","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45342","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6KTACJSABEKBQTYYPFKDEOPJ4JOG4FBE/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1197664","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-45341","description":"A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.","status":"published","published":"2022-01-25T00:00:00Z","modified":"2024-08-04T04:39:20.387Z","updated_at":"2026-11-02T14:33:02.580561Z"}],"euvd":[{"id":"EUVD-2021-32114","description":"A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.","status":"published","published":"2022-01-25T00:00:00Z","modified":"2024-08-04T04:39:20Z","updated_at":"2026-11-03T03:08:27.448176Z"}],"ghsa":[{"id":"GHSA-9882-476q-39vf","title":"A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and...","description":"A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.","status":"published","published":"2022-02-15T00:03:22Z","modified":"2023-05-30T05:00:43Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:54:37.218716Z"}],"nvd":[{"id":"CVE-2021-45341","description":"A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.","status":"published","published":"2022-01-25T12:15:07.693Z","modified":"2026-06-17T04:13:17.58Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:07:03.821385Z"}],"osv":[{"id":"CVE-2021-45341","description":"A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.","status":"published","published":"2022-01-25T12:15:07.693Z","modified":"2026-10-20T10:54:11.872221716Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:22.18434Z"},{"id":"DEBIAN-CVE-2021-45341","description":"A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.","status":"published","published":"2022-01-25T12:15:07.693Z","modified":"2026-10-23T18:04:17.045885016Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"UBUNTU-CVE-2021-45341","description":"A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.","status":"published","published":"2022-01-25T12:15:00Z","modified":"2026-02-04T02:52:45.41528Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:30.277322Z"},{"id":"DLA-2908-1","title":"librecad - security update","status":"published","published":"2022-02-03T00:00:00Z","modified":"2026-03-09T01:20:24.005251Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5077-1","title":"librecad - security update","status":"published","published":"2022-02-15T00:00:00Z","modified":"2026-03-09T02:11:27.838044Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0152","title":"Updated librecad packages fix security vulnerability","description":"A buffer overflow vulnerability in CDataMoji of the jwwlib component of\nLibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code\nExecution using a crafted JWW document. (CVE-2021-45341)\n\nA buffer overflow vulnerability in CDataList of the jwwlib component of\nLibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code\nExecution using a crafted JWW document. (CVE-2021-45342)\n","status":"published","published":"2022-04-24T10:43:54Z","modified":"2026-04-16T04:42:44.768132172Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0143-1","title":"Security update for librecad","description":"This update for librecad fixes the following issues:\n\n- CVE-2021-45341: Fixed a buffer overflow vulnerability in LibreCAD that allowed an attacker to achieve remote code execution via a crafted JWW document [boo#1195105] \n- CVE-2021-45342: Fixed a buffer overflow vulnerability in jwwlib in LibreCAD allows an attacker to achieve remote code execution via a crafted JWW document [boo#1195122] \n","status":"published","published":"2022-05-23T09:05:21Z","modified":"2026-02-04T02:22:32.596447Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:10002-1","title":"Security update for librecad","description":"This update for librecad fixes the following issues:\n\n- CVE-2021-45341: Fixed a buffer overflow vulnerability in LibreCAD allows an attacker to achieve remote code execution via a crafted JWW document [boo#1195105]\n- CVE-2021-45342: Fixed a buffer overflow vulnerability in jwwlib in LibreCAD allows an attacker to achieve remote code execution via a crafted JWW document [boo#1195122]\n\n- Strip excess blank fields from librecad.desktop:MimeType [boo#1197664]\n\nUpdate to 2.2.0-rc3\n\n  * major release\n  * DWG imports are more reliable now\n  * and a lot more of bugfixes and improvements\n","status":"published","published":"2022-05-31T17:32:38Z","modified":"2026-02-04T04:13:35.695144Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12082-1","title":"librecad-2.2.0~rc3-7.1 on GA media","description":"These are all security issues fixed in the librecad-2.2.0~rc3-7.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:40:02.124333Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"USN-5957-1","title":"librecad vulnerabilities","description":"Cody Sixteen discovered that LibreCAD incorrectly\nhandled memory when parsing DXF files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service. This issue only affected\nUbuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-19105)\n\nLilith of Cisco Talos discovered that LibreCAD incorrectly\nhandled memory when parsing DWG files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service, or possibly execute arbitrary code.\n(CVE-2021-21898, CVE-2021-21899)\n\nLilith of Cisco Talos discovered that LibreCAD incorrectly\nhandled memory when parsing DRW files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service, or possibly execute arbitrary code.\n(CVE-2021-21900)\n\nAlbin Eldstål-Ahrens discovered that LibreCAD incorrectly\nhandled memory when parsing JWW files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service, or possibly execute arbitrary code.\n(CVE-2021-45341, CVE-2021-45342)\n\nAlbin Eldstål-Ahrens discovered that LibreCAD incorrectly\nhandled memory when parsing DXF files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service. (CVE-2021-45343)\n","status":"published","published":"2023-03-15T16:20:03Z","modified":"2026-06-25T13:31:54.198205802Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}