CVE-2005-3302: Code Injection
Eval injection vulnerability in bvhimport.py in Blender 2.36 allows attackers to execute arbitrary Python code via a hierarchy element in a .bvh file, which is supplied to an eval function call.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/blenderto a version that resolves this vulnerability.Fixed in 2.37a-1 - Upgrade
Upgrade
debian/blenderto a version that resolves this vulnerability.Fixed in 3.4.1+dfsg-2Fixed in 4.3.2+dfsg-2Fixed in 5.2.2+dfsg-1
Event History
Frequently Asked Questions
What is the severity of CVE-2005-3302?
CVE-2005-3302 has been classified as a critical vulnerability due to its ability to allow arbitrary code execution.
How do I fix CVE-2005-3302?
To fix CVE-2005-3302, upgrade Blender to a version beyond 2.36 where the eval injection vulnerability is patched.
Which versions of Blender are affected by CVE-2005-3302?
Blender version 2.36 is affected by CVE-2005-3302, which allows for eval injection vulnerabilities.
What kind of attacks can exploit CVE-2005-3302?
CVE-2005-3302 can be exploited by attackers to execute arbitrary Python code through a crafted .bvh file.
Is CVE-2005-3302 relevant to Debian users?
Yes, CVE-2005-3302 impacts Debian 3.1 users who may use the affected version of Blender.