{"id":"CVE-2021-45343","aliases":["DEBIAN-CVE-2021-45343","DLA-2908-1","DSA-5077-1","EUVD-2021-32116","GHSA-xcgm-pvwf-mjq7","MGASA-2022-0151","UBUNTU-CVE-2021-45343","USN-5957-1"],"status":"published","title":"In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an...","description":"In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00896,"percentile":0.59851,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2022-01-25T00:00:00Z","modified":"2026-10-23T18:04:50Z","fixes":[{"ecosystem":"Debian:12","package":"librecad","fixed_in":["2.1.3-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"librecad","fixed_in":["2.1.3-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"librecad","fixed_in":["2.1.3-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librecad","fixed_in":["2.0.9-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"librecad","fixed_in":["2.1.2-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librecad","fixed_in":["2.1.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"librecad","fixed_in":["2.1.3-1.2+deb10u1build0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"librecad","fixed_in":["2.1.3-3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-3"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1+deb9u3"}]}],"versions":["2.1.2-1","2.1.2-1+deb9u1","2.1.2-1+deb9u2"],"bundled":3},{"source":"osv","ecosystem":"Debian:10","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1.2+deb10u1"}]}],"versions":["2.1.3-1.2"],"bundled":6},{"source":"osv","ecosystem":"Debian:11","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1.3+deb11u1"}]}],"versions":["2.1.3-1.3"],"bundled":6},{"source":"osv","ecosystem":"Mageia:8","package":"libdxfrw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.1.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-2ubuntu0.1~esm1"}]}],"versions":["2.0.4-1build1","2.0.8-1","2.0.9-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1ubuntu0.1"}]}],"versions":["2.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1ubuntu0.1~esm1"}]}],"versions":["2.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1.2+deb10u1build0.20.04.1"}]}],"versions":["2.1.3-1.2","2.1.3-1.2build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-3"}]}],"versions":["2.1.3-1.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-2ubuntu0.1~esm1"}]}],"versions":["2.0.4-1build1","2.0.8-1","2.0.9-2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1ubuntu0.1~esm1"}]}],"versions":["2.1.2-1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"librecad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1.2+deb10u1build0.20.04.1"}]}],"versions":["2.1.3-1.2","2.1.3-1.2build1"],"bundled":7}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"librecad","product":"librecad"}],"references":[{"url":"https://github.com/LibreCAD/LibreCAD/issues/1468","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUMH3CWGVSMR2UIZEA35Q5UB7PDVVVYS/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://www.debian.org/security/2022/dsa-5077","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCC2FZ6HZOIK3775K4MTCOUHX6PLGPEL/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202305-26","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45343"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUMH3CWGVSMR2UIZEA35Q5UB7PDVVVYS/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FCC2FZ6HZOIK3775K4MTCOUHX6PLGPEL/"},{"url":"https://github.com/advisories/GHSA-xcgm-pvwf-mjq7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-45343","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0151.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29720","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/RDI3HCTCACMIC7I4ILB3NRU6DCMADI5H/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2021/dla-2838","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/VUMH3CWGVSMR2UIZEA35Q5UB7PDVVVYS/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6TWLTKRSHNPCLQL7UXQSITHNYJT5XSK5/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-45343","tags":["report"]},{"url":"https://github.com/LibreCAD/LibreCAD/pull/1469","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5957-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21898","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21900","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-45341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-45342","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-45343","description":"In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document.","status":"published","published":"2022-01-25T00:00:00Z","modified":"2024-08-04T04:39:20.565Z","updated_at":"2026-11-02T14:33:02.580561Z"}],"euvd":[{"id":"EUVD-2021-32116","description":"In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document.","status":"published","published":"2022-01-25T00:00:00Z","modified":"2024-08-04T04:39:20Z","updated_at":"2026-11-03T03:08:27.448176Z"}],"ghsa":[{"id":"GHSA-xcgm-pvwf-mjq7","title":"In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an...","description":"In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document.","status":"published","published":"2022-02-15T00:03:21Z","modified":"2023-05-30T05:00:39Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:54:37.218716Z"}],"nvd":[{"id":"CVE-2021-45343","description":"In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document.","status":"published","published":"2022-01-25T13:15:07.873Z","modified":"2026-06-17T04:13:17.937Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:07:03.821385Z"}],"osv":[{"id":"CVE-2021-45343","description":"In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document.","status":"published","published":"2022-01-25T13:15:07.873Z","modified":"2026-10-20T10:54:11.650680467Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:22.18434Z"},{"id":"DEBIAN-CVE-2021-45343","description":"In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document.","status":"published","published":"2022-01-25T13:15:07.873Z","modified":"2026-10-23T18:04:50.801127315Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"UBUNTU-CVE-2021-45343","description":"In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted DXF document.","status":"published","published":"2022-01-25T13:15:00Z","modified":"2026-02-04T04:07:38.484637Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:30.277322Z"},{"id":"DLA-2908-1","title":"librecad - security update","status":"published","published":"2022-02-03T00:00:00Z","modified":"2026-03-09T01:20:24.005251Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5077-1","title":"librecad - security update","status":"published","published":"2022-02-15T00:00:00Z","modified":"2026-03-09T02:11:27.838044Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0151","title":"Updated libdxfrw packages fix security vulnerability","description":"A code execution vulnerability exists in the dwgCompressor::decompress18()\nfunctionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted\n.dwg file can lead to an out-of-bounds write. An attacker can provide a \nmalicious file to trigger this vulnerability. (CVE-2021-21898)\n\nA code execution vulnerability exists in the dwgCompressor::copyCompBytes21\nfunctionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted\n.dwg file can lead to a heap buffer overflow. An attacker can provide a\nmalicious file to trigger this vulnerability. (CVE-2021-21899)\n\nA code execution vulnerability exists in the dxfRW::processLType()\nfunctionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted\n.dxf file can lead to a use-after-free vulnerability. An attacker can provide\na malicious file to trigger this vulnerability. (CVE-2021-21900)\n\nIn LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw\nallows an attacker to crash the application using a crafted DXF document.\n(CVE-2021-45343)\n","status":"published","published":"2022-04-24T10:43:54Z","modified":"2026-04-16T04:44:29.301389194Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"USN-5957-1","title":"librecad vulnerabilities","description":"Cody Sixteen discovered that LibreCAD incorrectly\nhandled memory when parsing DXF files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service. This issue only affected\nUbuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-19105)\n\nLilith of Cisco Talos discovered that LibreCAD incorrectly\nhandled memory when parsing DWG files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service, or possibly execute arbitrary code.\n(CVE-2021-21898, CVE-2021-21899)\n\nLilith of Cisco Talos discovered that LibreCAD incorrectly\nhandled memory when parsing DRW files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service, or possibly execute arbitrary code.\n(CVE-2021-21900)\n\nAlbin Eldstål-Ahrens discovered that LibreCAD incorrectly\nhandled memory when parsing JWW files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service, or possibly execute arbitrary code.\n(CVE-2021-45341, CVE-2021-45342)\n\nAlbin Eldstål-Ahrens discovered that LibreCAD incorrectly\nhandled memory when parsing DXF files. An attacker could\nuse this issue to cause LibreCAD to crash, leading to a\ndenial of service. (CVE-2021-45343)\n","status":"published","published":"2023-03-15T16:20:03Z","modified":"2026-06-25T13:31:54.198205802Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}