CVE-2023-30259: 
NixOS vulnerability analysis and mitigation

A Buffer Overflow vulnerability exists in the importshp plugin of LibreCAD 2.2.0 that allows attackers to obtain sensitive information via a crafted DBF file. The vulnerability was discovered and disclosed in December 2021 (GitHub Issue).

The vulnerability is an out-of-bounds read on a heap buffer in the importshp plugin. The issue occurs due to mismatched sizes in the DBF file header processing. The dbfopen.c module parses file and field headers into an internal structure without performing sanity checks on nRecordLength, allowing it to be significantly smaller than the actual record size. This mismatch can cause strncpy() to copy more data than intended, reading outside the bounds of the allocated heap buffer. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) (NVD).

The vulnerability can lead to the disclosure of sensitive information through an out-of-bounds read. This can potentially be used to bypass automatic security features such as stack canaries and pointer encryption (GitHub Issue).

The vulnerability has been fixed in LibreCAD version 2.2.0.2-1. The fix involves updating the bundled shapelib with an up-to-date version from OSGeo/shapelib, which includes a sanity check for the record length in the DBF header (Debian Security).