CVE-2023-5179

View on CVE.org

Published Nov 7, 2023 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

An issue was discovered in Open Design Alliance Drawings SDK before 2024.10. A corrupted value for the start of MiniFat sector in a crafted DGN file leads to an out-of-bounds read. This can allow attackers to cause a crash, potentially enabling a denial-of-service attack (Crash, Exit, or Restart) or possible code execution.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Open Design Alliance

ODA Drawings SDK - All Versions < 2024.10

unaffected

Version	Status	Constraints
`0`	affected	< 2024.10

Configuration 1 [-]

cpe:2.3:a:opendesign:drawings_sdk:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2023-57516	An issue was discovered in Open Design Alliance Drawings SDK before 2024.10. A corrupted value for the start of MiniFat sector in a crafted DGN file leads to an out-of-bounds read. This can allow attackers to cause a crash, potentially enabling a denial-of-service attack (Crash, Exit, or Restart) or possible code execution.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.307% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://www.opendesign.com/security-advisories

History

No history.

Subscriptions

Opendesign Drawings Sdk

Weaknesses

CWE-125

Sources

CVE record Updated: Sep 4, 2024, 7:43 PM

Status: PUBLISHED
Assigner: ODA
Published: Nov 7, 2023, 3:16 PM
Updated: Sep 4, 2024, 7:43 PM
Reserved: Sep 25, 2023, 5:08 PM

View source JSON

Vulnrichment Updated: Aug 2, 2024, 7:52 AM

Updated: Aug 2, 2024, 7:52 AM

NVD Updated: Jun 17, 2026, 6:47 AM

Status: Modified
Published: Nov 7, 2023, 4:15 PM
Modified: Jun 17, 2026, 6:47 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-5179", "assignerOrgId": "8a9629cb-c5e7-4d2a-a894-111e8039b7ea", "state": "PUBLISHED", "assignerShortName": "ODA", "dateReserved": "2023-09-25T17:08:14.420Z", "datePublished": "2023-11-07T15:16:22.607Z", "dateUpdated": "2024-09-04T19:43:42.670Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ODA Drawings SDK - All Versions < 2024.10", "vendor": "Open Design Alliance", "versions": [{"lessThan": "2024.10", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Seyit S\u0131\u011f\u0131rc\u0131"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An issue was discovered in Open Design Alliance Drawings SDK before 2024.10. A corrupted value for the start of MiniFat sector in a crafted DGN file leads to an out-of-bounds read. This can allow attackers to cause a crash, potentially enabling a denial-of-service attack (Crash, Exit, or Restart) or possible code execution. </p>\n\n\n"}], "value": "An issue was discovered in Open Design Alliance Drawings SDK before 2024.10. A corrupted value for the start of MiniFat sector in a crafted DGN file leads to an out-of-bounds read. This can allow attackers to cause a crash, potentially enabling a denial-of-service attack (Crash, Exit, or Restart) or possible code execution. \n\n\n\n\n"}], "impacts": [{"capecId": "CAPEC-540", "descriptions": [{"lang": "en", "value": "CAPEC-540 Overread Buffers"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8a9629cb-c5e7-4d2a-a894-111e8039b7ea", "shortName": "ODA", "dateUpdated": "2023-11-07T15:16:29.985Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.opendesign.com/security-advisories"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:52:08.516Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://www.opendesign.com/security-advisories"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-04T19:41:13.254763Z", "id": "CVE-2023-5179", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-04T19:43:42.670Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.opendesign.com/security-advisories", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:52:08.516Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-5179", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-04T19:41:13.254763Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-04T19:41:24.480Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Seyit S\u0131\u011f\u0131rc\u0131"}], "impacts": [{"capecId": "CAPEC-540", "descriptions": [{"lang": "en", "value": "CAPEC-540 Overread Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Open Design Alliance", "product": "ODA Drawings SDK - All Versions < 2024.10", "versions": [{"status": "affected", "version": "0", "lessThan": "2024.10", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.opendesign.com/security-advisories", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in Open Design Alliance Drawings SDK before 2024.10. A corrupted value for the start of MiniFat sector in a crafted DGN file leads to an out-of-bounds read. This can allow attackers to cause a crash, potentially enabling a denial-of-service attack (Crash, Exit, or Restart) or possible code execution. \n\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "<p>An issue was discovered in Open Design Alliance Drawings SDK before 2024.10. A corrupted value for the start of MiniFat sector in a crafted DGN file leads to an out-of-bounds read. This can allow attackers to cause a crash, potentially enabling a denial-of-service attack (Crash, Exit, or Restart) or possible code execution. </p>\n\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "8a9629cb-c5e7-4d2a-a894-111e8039b7ea", "shortName": "ODA", "dateUpdated": "2023-11-07T15:16:29.985Z"}}}, "cveMetadata": {"cveId": "CVE-2023-5179", "state": "PUBLISHED", "dateUpdated": "2024-09-04T19:43:42.670Z", "dateReserved": "2023-09-25T17:08:14.420Z", "assignerOrgId": "8a9629cb-c5e7-4d2a-a894-111e8039b7ea", "datePublished": "2023-11-07T15:16:22.607Z", "assignerShortName": "ODA"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ODA Drawings SDK - All Versions < 2024.10", "vendor": "Open Design Alliance", "versions": [{"lessThan": "2024.10", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "8a9629cb-c5e7-4d2a-a894-111e8039b7ea"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opendesign:drawings_sdk:*:*:*:*:*:*:*:*", "matchCriteriaId": "163A6555-0C98-45A6-99E1-E7DF7D977DE8", "versionEndExcluding": "2024.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in Open Design Alliance Drawings SDK before 2024.10. A corrupted value for the start of MiniFat sector in a crafted DGN file leads to an out-of-bounds read. This can allow attackers to cause a crash, potentially enabling a denial-of-service attack (Crash, Exit, or Restart) or possible code execution. \n\n\n\n\n"}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Open Design Alliance Drawings SDK antes de la versi\u00f3n 2024.10. Un valor da\u00f1ado para el inicio del sector MiniFat en un archivo DGN manipulado genera una lectura fuera de los l\u00edmites. Esto puede permitir a los atacantes provocar un bloqueo, lo que podr\u00eda permitir un ataque de Denegaci\u00f3n de Servicio (DoS) (bloqueo, salida o reinicio) o una posible ejecuci\u00f3n de c\u00f3digo."}], "id": "CVE-2023-5179", "lastModified": "2026-06-17T06:47:44.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "8a9629cb-c5e7-4d2a-a894-111e8039b7ea", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-5179", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-09-04T19:41:13.254763Z", "version": "2.0.3"}}]}, "published": "2023-11-07T16:15:29.550", "references": [{"source": "8a9629cb-c5e7-4d2a-a894-111e8039b7ea", "tags": ["Vendor Advisory"], "url": "https://www.opendesign.com/security-advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.opendesign.com/security-advisories"}], "sourceIdentifier": "8a9629cb-c5e7-4d2a-a894-111e8039b7ea", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "8a9629cb-c5e7-4d2a-a894-111e8039b7ea", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}