CVE-2021-45845

The Path Sanity Check script of FreeCAD 0.19 is vulnerable to OS command injection, allowing an attacker to execute arbitrary commands via a crafted FCStd document.

References

Affected packages

Debian:11 / freecad

Package

Name: freecad
Purl: pkg:deb/debian/freecad?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.19.1+dfsg1-2+deb11u1

Affected versions

0.*

0.19.1+dfsg1-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / freecad

Package

Name: freecad
Purl: pkg:deb/debian/freecad?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.19.4+dfsg1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / freecad

Package

Name: freecad
Purl: pkg:deb/debian/freecad?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.19.4+dfsg1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/freecad/freecad

Affected ranges

Type: GIT
Repo: https://github.com/freecad/freecad
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

d29fd7d9cb9fb280a1eb47f55e3c73c46d637ba2

Affected versions

0.*

0.16

0.17

0.18

0.19