CVE-2023-26157 Denial of service in libredwg
An out-of-bounds read in libredwg allows attackers to cause a denial of service via crafted DWG files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-26157?
CVE-2023-26157 is a medium-severity denial of service vulnerability in Gnu Libredwg, published on 2 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section->num_pages in decode_r2007.c.
Which versions are affected by CVE-2023-26157?
It affects 1 product.
Linux distribution packages (3)
libredwg SUSE:Package Hub 15 SP5 | All versions | 0.12.5.6924-bp155.3.6.1 |
libredwg openSUSE:Leap 15.5 | All versions | 0.12.5.6924-bp155.3.6.1 |
libredwg openSUSE:Tumbleweed | All versions | 0.12.5.6924-1.1 |
Products include Gnu Libredwg.
How do I fix CVE-2023-26157?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-26157 being exploited?
There is no known exploitation of CVE-2023-26157 in the wild and no public exploit code.
Other vulnerabilities in Gnu Libredwg
Sources
Also known as GHSA-5rxp-9658-h93v, openSUSE-SU-2024:0147-1, openSUSE-SU-2024:13544-1.