UBUNTU-CVE-2017-2907
Dashboard / Vulnerabilities / UBUNTU-CVE-2017-2907
Summary:
Details: An exploitable integer overflow exists in the animation playing functionality of the Blender open-source 3d creation suite version 2.78c. A specially created '.avi' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset in order to trigger this vulnerability.
References: https://ubuntu.com/security/CVE-2017-2907, https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0414, https://git.blender.org/gitweb/gitweb.cgi/blender.git/commit/d30cc1ea0b9ba64d8a1e22105528b6cb8077692c, https://www.cve.org/CVERecord?id=CVE-2017-2907
Affected packages
Package
Name: blender
Purl: pkg:deb/ubuntu/[email protected]+dfsg0-3build1?arch=source&distro=xenial
Affected ranges
Type: ECOSYSTEM
Events:
