FreeCAD 1.1.2 Security Update: Fixes Code Execution via Malicious FCSdf Files

FreeCAD 1.1.2 Vulnerability Summary Vulnerability Overview FreeCAD 1.1.2 is a maintenance release containing multiple security fixes for code execution and other file processing vulnerabilities. These vulnerabilities can be triggered by opening maliciously crafted FCSdf files. Scope of Impact All previously released versions are affected by one or more of the above issues. Therefore, it is strongly recommended that all users upgrade, especially those who open FreeCAD files from untrusted or unknown sources. Remediation Code Execution Vulnerabilities: Prevents code execution by fixing the processing logic for maliciously crafted FCSdf files. File Processing Vulnerabilities: Improves file processing mechanisms to ensure the security and integrity of file contents. Specific Fixes BIM: Fixed projection direction of hidden geometry. BIM: Fixed double-click visibility behavior for views in the view. Let setupTitleBar: Replaces the existing title bar to avoid deleting any content. CAM: Supports font scaling in the CAM tool widget. Sketcher: Preserves local overlay depth for dimensions and grids. FEM: Highlights the composite popup tool selection. PartDesign: Fixes the startup issue of the Chamfer tool in selection mode. App: Uses ModDirs as the authoritative list for loading modules. core: Fixes issues allowing navigation, drawing, orbiting, and other operations. BIM: Fixes duplicate handling in IFC export. TechDraw: Prevents crashes when loading documents. Draft: Fixes color regression in clone diffusion. Draft: Disables shape string updates after entering coordinates in the task panel. TechDraw: Does not maximize MDIView on close. BIM: Fixes precision issues in roof subtraction. core: Fixes cmake build errors. Gui: Fixes potential crashes in . Gui: Fixes potential crashes during opening and dragging. Gui: Disables drag-and-drop for coordinate systems. Part: Fixes crashes in . App: Fixes crashes in . PartDesign: Fixes issues in two pipelines. Style: Grays out text in non-visible objects. Fem: Updates analysis type and eigenvalue limit properties. Assembly: Fixes the issue where double-clicking AssemblyLink does not work. BIM: Updates BIM classification download URLs. Core: Adds version warning dialog and preferences. Draft: Updates icons for Shape2DView. Draft: Updates . Gui: Fixes automatic object selection after deletion. CAM: Fixes Vcarve file steps. BIM: Fixes shaft-like object filling in TechDraw. BIM: Fixes issues in . BIM: Fixes broken preset paths. Gui: Applies stylesheets only if changed. BIM: Fixes import issues. BIM: Fixes shaft-like object filling in . Draft: Fixes cross-section pairing. Pin: Fixes Windows runner to Windows-2022. Sketcher: Adds inverse mapping correction. App: Adds and . Update ArchPipe.py: Updates . CI: Runs expensive CI only after initial PR approval. CAM: Fixes issues where safety depth, start depth, and final depth values are identical in CAM operations. Merge pull request: Merges pull request from . BIM: Fixes issues where opening doors or windows or their orientation should touch the host. App: Handles symbolic links in and . App/BIM/Draft: Uses for more robust referencing. Gui: Improves drag-and-drop for annotation labels. App: Retrieves attached names from Metadata. Escape strings: Escapes strings when passed to the interpreter. Fix #30706: Allows macro directories as a source for PropertyPythonObject. Fix weekly Linux and Windows package builds: Fixes weekly Linux and Windows package builds. Draft: Increases center point tolerance for angular dimensions. Gui: Fixes slow application startup caused by the SplashScreen. Base: Hardens the FCSdf reader to prevent XXE. App: Prevents directory traversal in included files. FEM: Switches to C++ for setting text values. TD: Hardens face creation. Part: Ensures proper escaping of filenames. Robot: Ensures proper escaping of filenames. TD: Ensures proper escaping of quotes in filenames. CAM: Escapes user input to prevent code injection. Sanitize user-controlled strings: Sanitizes user-controlled strings. BIM: Fixes errors in #30001. Backport #30010: Backports to . TD: Adds missing . BIM: Removes call to BimTutorial. Cherry-pick security fixes: Cherry-picks security fixes. CAM: Fixes Cam eval blacklist. PD: Adds FuzzyTolerance property. SketcherMeasure: Fixes precision loss in dimensions and measurements. Sketcher: Fixes #28639, restores pre-selection highlighting of faces. Robot: Escapes strings. Build: Updates version to 1.1.2. Full Changelog 1.1.1...1.1.2 Contributors chenne, ElementW, and 29 other contributors. Assets 18 assets. Reactions 51 reactions.

Goal Reached Thanks to every supporter — we hit 100%!

FreeCAD 1.1.2 Security Update: Fixes Code Execution via Malicious FCSdf Files

More from this source