Already announced several times, new obstacles kept appearing. It took far too long to present this new stable LibreCAD version.

But this is a worst case scenario, which I would rate as extremely low to occur.

With some efforts an attacker possibly can create a shape file, which can lead to unintended code execution and seize your computer.

The vulnerability is an out-of-bounds read, what means, if a malformed shape file is imported, the application can crash.

If you are a surveyor and need the shape file support, it is safe to stay with 2.2.0 version, as long as you know the origin of the used shape files.

As this is probably not a widely used plugin, the fix was just to remove the plugin.

Shape files are used in surveying and so do not affect the most users.

The vulnerability addresses only the plugin Importshp, which is used to import shape files (SHP/SHX/DBF).

It fixes a minor vulnerability (CVE-2023-30259) with a mature shapelib contained in our codebase.

This is a bugfix release for official stable release 2.2.0. Meanwhile, for LibreCAD 2.2.0 series, Qt5 is mandatory. The Qt4 porting was completed eventually during the development of 2.0.0 series, thanks to our master developer Rallaz, and LibreCAD has become Qt3 free except in the 1.0.0 series. Porting the rendering engine to Qt4 proved to be a large task, so LibreCAD initially still depended on the Qt3 support library. After some discussion within the community and research on existing names, CADuntu was renamed to LibreCAD.

The project was known as CADuntu only for a couple of months before the community decided that the name was inappropriate. Since QCad CE was built around the outdated Qt3 library, it had to be ported to Qt4 before additional enhancements.

LibreCAD started as a project to build CAM capabilities into the community version of QCad for use with a Mechmate CNC router. It’s available in over 30 languages with cross-platform support for macOS, Windows, and Linux.

Downloading LibreCAD 2.2.0.1