OPENSUSE-SU-2020:0068-1
Vulnerability from csaf_opensuse - Published: 2020-01-17 11:15 - Updated: 2026-09-20 19:02Summary
Security update for libredwg
Severity
Moderate
Notes
Title of the patch: Security update for libredwg
Description of the patch: This update for libredwg fixes the following issues:
libredwg was updated to release 0.9.3:
* Added the -x,--extnames option to dwglayers for r13-r14 DWGs.
* Fixed some leaks: SORTENTSTABLE, PROXY_ENTITY.ownerhandle
for r13.
* Add DICTIONARY.itemhandles[] for r13 and r14.
* Fixed some dwglayers null pointer derefs, and flush its output
for each layer.
* Added several overflow checks from fuzzing
[CVE-2019-20010, boo#1159825], [CVE-2019-20011, boo#1159826],
[CVE-2019-20012, boo#1159827], [CVE-2019-20013, boo#1159828],
[CVE-2019-20014, boo#1159831], [CVE-2019-20015, boo#1159832]
* Disallow illegal SPLINE scenarios
[CVE-2019-20009, boo#1159824]
Update to release 0.9.1:
* Fixed more null pointer dereferences, overflows, hangs and
memory leaks for fuzzed (i.e. illegal) DWGs.
Update to release 0.9 [boo#1154080]:
* Added the DXF importer, using the new dynapi and the r2000
encoder. Only for r2000 DXFs.
* Added utf8text conversion functions to the dynapi.
* Added 3DSOLID encoder.
* Added APIs to find handles for names, searching in tables
and dicts.
* API breaking changes - see NEWS file in package.
* Fixed null pointer dereferences, and memory leaks (except DXF
importer)
[boo#1129868, CVE-2019-9779]
[boo#1129869, CVE-2019-9778]
[boo#1129870, CVE-2019-9777]
[boo#1129873, CVE-2019-9776]
[boo#1129874, CVE-2019-9773]
[boo#1129875, CVE-2019-9772]
[boo#1129876, CVE-2019-9771]
[boo#1129878, CVE-2019-9775]
[boo#1129879, CVE-2019-9774]
[boo#1129881, CVE-2019-9770]
Update to 0.8:
* add a new dynamic API, read and write all header and object
fields by name
* API breaking changes
* Fix many errors in DXF output
* Fix JSON output
* Many more bug fixes to handle specific object types
Patchnames: openSUSE-2020-68
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
6.5 (Medium)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2019-20009
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2019-20009
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
3 products, the same list as for
CVE-2019-20009
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
3 products, the same list as for
CVE-2019-20009
Threats
Impact
moderate
8.8 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2019-20009
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
3 products, the same list as for
CVE-2019-20009
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2019-20009
Threats
Impact
critical
7.5 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2019-20009
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2019-20009
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2019-20009
Threats
Impact
moderate
9.1 (Critical)
Affected products
Recommended
3 products, the same list as for
CVE-2019-20009
Threats
Impact
important
9.1 (Critical)
Affected products
Recommended
3 products, the same list as for
CVE-2019-20009
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2019-20009
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2019-20009
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2019-20009
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
3 products, the same list as for
CVE-2019-20009
Threats
Impact
moderate
References
76 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for libredwg",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for libredwg fixes the following issues:\n\nlibredwg was updated to release 0.9.3:\n\n* Added the -x,--extnames option to dwglayers for r13-r14 DWGs.\n* Fixed some leaks: SORTENTSTABLE, PROXY_ENTITY.ownerhandle\n for r13.\n* Add DICTIONARY.itemhandles[] for r13 and r14.\n* Fixed some dwglayers null pointer derefs, and flush its output\n for each layer.\n* Added several overflow checks from fuzzing\n [CVE-2019-20010, boo#1159825], [CVE-2019-20011, boo#1159826],\n [CVE-2019-20012, boo#1159827], [CVE-2019-20013, boo#1159828],\n [CVE-2019-20014, boo#1159831], [CVE-2019-20015, boo#1159832]\n* Disallow illegal SPLINE scenarios\n [CVE-2019-20009, boo#1159824]\n\nUpdate to release 0.9.1:\n\n* Fixed more null pointer dereferences, overflows, hangs and\n memory leaks for fuzzed (i.e. illegal) DWGs.\n\nUpdate to release 0.9 [boo#1154080]:\n\n* Added the DXF importer, using the new dynapi and the r2000\n encoder. Only for r2000 DXFs.\n* Added utf8text conversion functions to the dynapi.\n* Added 3DSOLID encoder.\n* Added APIs to find handles for names, searching in tables\n and dicts.\n* API breaking changes - see NEWS file in package.\n* Fixed null pointer dereferences, and memory leaks (except DXF\n importer)\n [boo#1129868, CVE-2019-9779]\n [boo#1129869, CVE-2019-9778]\n [boo#1129870, CVE-2019-9777]\n [boo#1129873, CVE-2019-9776]\n [boo#1129874, CVE-2019-9773]\n [boo#1129875, CVE-2019-9772]\n [boo#1129876, CVE-2019-9771]\n [boo#1129878, CVE-2019-9775]\n [boo#1129879, CVE-2019-9774]\n [boo#1129881, CVE-2019-9770]\n\nUpdate to 0.8:\n\n* add a new dynamic API, read and write all header and object\n fields by name\n* API breaking changes\n* Fix many errors in DXF output\n* Fix JSON output\n* Many more bug fixes to handle specific object types\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2020-68",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_0068-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2020:0068-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7MX6MDGMFDNPZMSX3CCI2TRTGEYIQOL6/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2020:0068-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7MX6MDGMFDNPZMSX3CCI2TRTGEYIQOL6/"
},
{
"category": "self",
"summary": "SUSE Bug 1129868",
"url": "https://bugzilla.suse.com/1129868"
},
{
"category": "self",
"summary": "SUSE Bug 1129869",
"url": "https://bugzilla.suse.com/1129869"
},
{
"category": "self",
"summary": "SUSE Bug 1129870",
"url": "https://bugzilla.suse.com/1129870"
},
{
"category": "self",
"summary": "SUSE Bug 1129873",
"url": "https://bugzilla.suse.com/1129873"
},
{
"category": "self",
"summary": "SUSE Bug 1129874",
"url": "https://bugzilla.suse.com/1129874"
},
{
"category": "self",
"summary": "SUSE Bug 1129875",
"url": "https://bugzilla.suse.com/1129875"
},
{
"category": "self",
"summary": "SUSE Bug 1129876",
"url": "https://bugzilla.suse.com/1129876"
},
{
"category": "self",
"summary": "SUSE Bug 1129878",
"url": "https://bugzilla.suse.com/1129878"
},
{
"category": "self",
"summary": "SUSE Bug 1129879",
"url": "https://bugzilla.suse.com/1129879"
},
{
"category": "self",
"summary": "SUSE Bug 1129881",
"url": "https://bugzilla.suse.com/1129881"
},
{
"category": "self",
"summary": "SUSE Bug 1154080",
"url": "https://bugzilla.suse.com/1154080"
},
{
"category": "self",
"summary": "SUSE Bug 1159824",
"url": "https://bugzilla.suse.com/1159824"
},
{
"category": "self",
"summary": "SUSE Bug 1159825",
"url": "https://bugzilla.suse.com/1159825"
},
{
"category": "self",
"summary": "SUSE Bug 1159826",
"url": "https://bugzilla.suse.com/1159826"
},
{
"category": "self",
"summary": "SUSE Bug 1159827",
"url": "https://bugzilla.suse.com/1159827"
},
{
"category": "self",
"summary": "SUSE Bug 1159828",
"url": "https://bugzilla.suse.com/1159828"
},
{
"category": "self",
"summary": "SUSE Bug 1159831",
"url": "https://bugzilla.suse.com/1159831"
},
{
"category": "self",
"summary": "SUSE Bug 1159832",
"url": "https://bugzilla.suse.com/1159832"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20009 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20009/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20010 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20010/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20011 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20011/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20012 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20012/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20013 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20013/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20014 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20014/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20015 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20015/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-9770 page",
"url": "https://www.suse.com/security/cve/CVE-2019-9770/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-9771 page",
"url": "https://www.suse.com/security/cve/CVE-2019-9771/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-9772 page",
"url": "https://www.suse.com/security/cve/CVE-2019-9772/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-9773 page",
"url": "https://www.suse.com/security/cve/CVE-2019-9773/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-9774 page",
"url": "https://www.suse.com/security/cve/CVE-2019-9774/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-9775 page",
"url": "https://www.suse.com/security/cve/CVE-2019-9775/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-9776 page",
"url": "https://www.suse.com/security/cve/CVE-2019-9776/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-9777 page",
"url": "https://www.suse.com/security/cve/CVE-2019-9777/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-9778 page",
"url": "https://www.suse.com/security/cve/CVE-2019-9778/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-9779 page",
"url": "https://www.suse.com/security/cve/CVE-2019-9779/"
}
],
"title": "Security update for libredwg",
"tracking": {
"current_release_date": "2026-09-20T19:02:31Z",
"generator": {
"date": "2020-01-17T11:15:41Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2020:0068-1",
"initial_release_date": "2020-01-17T11:15:41Z",
"revision_history": [
{
"date": "2020-01-17T11:15:41Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-20T19:02:31Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"product": {
"name": "libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"product_id": "libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/libredwg-devel@0.9.3-lp151.2.3.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"product": {
"name": "libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"product_id": "libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/libredwg-tools@0.9.3-lp151.2.3.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libredwg0-0:0.9.3-lp151.2.3.1.x86_64",
"product": {
"name": "libredwg0-0:0.9.3-lp151.2.3.1.x86_64",
"product_id": "libredwg0-0:0.9.3-lp151.2.3.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/libredwg0@0.9.3-lp151.2.3.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 15.1",
"product": {
"name": "openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64"
},
"product_reference": "libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64"
},
"product_reference": "libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libredwg0-0:0.9.3-lp151.2.3.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
},
"product_reference": "libredwg0-0:0.9.3-lp151.2.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-20009",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20009"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_SPLINE_private in dwg.spec.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20009",
"url": "https://www.suse.com/security/cve/CVE-2019-20009"
},
{
"category": "external",
"summary": "SUSE Bug 1159824 for CVE-2019-20009",
"url": "https://bugzilla.suse.com/1159824"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-17T11:15:41Z",
"details": "moderate"
}
],
"title": "CVE-2019-20009"
},
{
"cve": "CVE-2019-20010",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20010"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU LibreDWG 0.92. There is a use-after-free in resolve_objectref_vector in decode.c.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20010",
"url": "https://www.suse.com/security/cve/CVE-2019-20010"
},
{
"category": "external",
"summary": "SUSE Bug 1159825 for CVE-2019-20010",
"url": "https://bugzilla.suse.com/1159825"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-17T11:15:41Z",
"details": "moderate"
}
],
"title": "CVE-2019-20010"
},
{
"cve": "CVE-2019-20011",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20011"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU LibreDWG 0.92. There is a heap-based buffer over-read in decode_R13_R2000 in decode.c.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20011",
"url": "https://www.suse.com/security/cve/CVE-2019-20011"
},
{
"category": "external",
"summary": "SUSE Bug 1159826 for CVE-2019-20011",
"url": "https://bugzilla.suse.com/1159826"
},
{
"category": "external",
"summary": "SUSE Bug 1174236 for CVE-2019-20011",
"url": "https://bugzilla.suse.com/1174236"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-17T11:15:41Z",
"details": "moderate"
}
],
"title": "CVE-2019-20011"
},
{
"cve": "CVE-2019-20012",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20012"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_HATCH_private in dwg.spec.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20012",
"url": "https://www.suse.com/security/cve/CVE-2019-20012"
},
{
"category": "external",
"summary": "SUSE Bug 1159827 for CVE-2019-20012",
"url": "https://bugzilla.suse.com/1159827"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-17T11:15:41Z",
"details": "moderate"
}
],
"title": "CVE-2019-20012"
},
{
"cve": "CVE-2019-20013",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20013"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessive memory allocation in decode_3dsolid in dwg.spec.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20013",
"url": "https://www.suse.com/security/cve/CVE-2019-20013"
},
{
"category": "external",
"summary": "SUSE Bug 1159828 for CVE-2019-20013",
"url": "https://bugzilla.suse.com/1159828"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-17T11:15:41Z",
"details": "moderate"
}
],
"title": "CVE-2019-20013"
},
{
"cve": "CVE-2019-20014",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20014"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU LibreDWG before 0.93. There is a double-free in dwg_free in free.c.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20014",
"url": "https://www.suse.com/security/cve/CVE-2019-20014"
},
{
"category": "external",
"summary": "SUSE Bug 1159831 for CVE-2019-20014",
"url": "https://bugzilla.suse.com/1159831"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-17T11:15:41Z",
"details": "moderate"
}
],
"title": "CVE-2019-20014"
},
{
"cve": "CVE-2019-20015",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20015"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_LWPOLYLINE_private in dwg.spec.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20015",
"url": "https://www.suse.com/security/cve/CVE-2019-20015"
},
{
"category": "external",
"summary": "SUSE Bug 1159832 for CVE-2019-20015",
"url": "https://bugzilla.suse.com/1159832"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-17T11:15:41Z",
"details": "moderate"
}
],
"title": "CVE-2019-20015"
},
{
"cve": "CVE-2019-9770",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-9770"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer overflow in the function dwg_decode_eed_data at decode.c for the y dimension.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-9770",
"url": "https://www.suse.com/security/cve/CVE-2019-9770"
},
{
"category": "external",
"summary": "SUSE Bug 1129881 for CVE-2019-9770",
"url": "https://bugzilla.suse.com/1129881"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-17T11:15:41Z",
"details": "critical"
}
],
"title": "CVE-2019-9770"
},
{
"cve": "CVE-2019-9771",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-9771"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a NULL pointer dereference in the function bit_convert_TU at bits.c.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-9771",
"url": "https://www.suse.com/security/cve/CVE-2019-9771"
},
{
"category": "external",
"summary": "SUSE Bug 1129876 for CVE-2019-9771",
"url": "https://bugzilla.suse.com/1129876"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-17T11:15:41Z",
"details": "moderate"
}
],
"title": "CVE-2019-9771"
},
{
"cve": "CVE-2019-9772",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-9772"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a NULL pointer dereference in the function dwg_dxf_LEADER at dwg.spec.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-9772",
"url": "https://www.suse.com/security/cve/CVE-2019-9772"
},
{
"category": "external",
"summary": "SUSE Bug 1129875 for CVE-2019-9772",
"url": "https://bugzilla.suse.com/1129875"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-17T11:15:41Z",
"details": "moderate"
}
],
"title": "CVE-2019-9772"
},
{
"cve": "CVE-2019-9773",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-9773"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer overflow in the function dwg_decode_eed_data at decode.c for the z dimension.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-9773",
"url": "https://www.suse.com/security/cve/CVE-2019-9773"
},
{
"category": "external",
"summary": "SUSE Bug 1129874 for CVE-2019-9773",
"url": "https://bugzilla.suse.com/1129874"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-17T11:15:41Z",
"details": "moderate"
}
],
"title": "CVE-2019-9773"
},
{
"cve": "CVE-2019-9774",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-9774"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is an out-of-bounds read in the function bit_read_B at bits.c.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-9774",
"url": "https://www.suse.com/security/cve/CVE-2019-9774"
},
{
"category": "external",
"summary": "SUSE Bug 1129879 for CVE-2019-9774",
"url": "https://bugzilla.suse.com/1129879"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-17T11:15:41Z",
"details": "important"
}
],
"title": "CVE-2019-9774"
},
{
"cve": "CVE-2019-9775",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-9775"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is an out-of-bounds read in the function dwg_dxf_BLOCK_CONTROL at dwg.spec.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-9775",
"url": "https://www.suse.com/security/cve/CVE-2019-9775"
},
{
"category": "external",
"summary": "SUSE Bug 1129878 for CVE-2019-9775",
"url": "https://bugzilla.suse.com/1129878"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-17T11:15:41Z",
"details": "important"
}
],
"title": "CVE-2019-9775"
},
{
"cve": "CVE-2019-9776",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-9776"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a NULL pointer dereference in the function dwg_dxf_LTYPE at dwg.spec (later than CVE-2019-9779).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-9776",
"url": "https://www.suse.com/security/cve/CVE-2019-9776"
},
{
"category": "external",
"summary": "SUSE Bug 1129868 for CVE-2019-9776",
"url": "https://bugzilla.suse.com/1129868"
},
{
"category": "external",
"summary": "SUSE Bug 1129873 for CVE-2019-9776",
"url": "https://bugzilla.suse.com/1129873"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-17T11:15:41Z",
"details": "moderate"
}
],
"title": "CVE-2019-9776"
},
{
"cve": "CVE-2019-9777",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-9777"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer over-read in the function dxf_header_write at header_variables_dxf.spec.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-9777",
"url": "https://www.suse.com/security/cve/CVE-2019-9777"
},
{
"category": "external",
"summary": "SUSE Bug 1129870 for CVE-2019-9777",
"url": "https://bugzilla.suse.com/1129870"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-17T11:15:41Z",
"details": "moderate"
}
],
"title": "CVE-2019-9777"
},
{
"cve": "CVE-2019-9778",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-9778"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer over-read in the function dwg_dxf_LTYPE at dwg.spec.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-9778",
"url": "https://www.suse.com/security/cve/CVE-2019-9778"
},
{
"category": "external",
"summary": "SUSE Bug 1129869 for CVE-2019-9778",
"url": "https://bugzilla.suse.com/1129869"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-17T11:15:41Z",
"details": "moderate"
}
],
"title": "CVE-2019-9778"
},
{
"cve": "CVE-2019-9779",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-9779"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a NULL pointer dereference in the function dwg_dxf_LTYPE at dwg.spec (earlier than CVE-2019-9776).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-9779",
"url": "https://www.suse.com/security/cve/CVE-2019-9779"
},
{
"category": "external",
"summary": "SUSE Bug 1129868 for CVE-2019-9779",
"url": "https://bugzilla.suse.com/1129868"
},
{
"category": "external",
"summary": "SUSE Bug 1129873 for CVE-2019-9779",
"url": "https://bugzilla.suse.com/1129873"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:libredwg-devel-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg-tools-0:0.9.3-lp151.2.3.1.x86_64",
"openSUSE Leap 15.1:libredwg0-0:0.9.3-lp151.2.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-01-17T11:15:41Z",
"details": "moderate"
}
],
"title": "CVE-2019-9779"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.