UBUNTU-CVE-2017-2903
Dashboard / Vulnerabilities / UBUNTU-CVE-2017-2903
Summary:
Details: An exploitable integer overflow exists in the DPX loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.cin' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.
References: https://ubuntu.com/security/CVE-2017-2903, https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0410, https://git.blender.org/gitweb/gitweb.cgi/blender.git/commit/d30cc1ea0b9ba64d8a1e22105528b6cb8077692c, https://www.cve.org/CVERecord?id=CVE-2017-2903
Affected packages
Package
Name: blender
Purl: pkg:deb/ubuntu/[email protected]+dfsg0-3build1?arch=source&distro=xenial
Affected ranges
Type: ECOSYSTEM
Events:
