CVE-2017-12082: Buffer Overflow
An exploitable integer overflow exists in the 'CustomData' Mesh loading functionality of the Blender open-source 3d creation suite. A .blend file with a specially crafted external data file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to edit an object within a .blend library in their Scene in order to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-12082?
CVE-2017-12082 is an integer overflow vulnerability in the CustomData Mesh loading functionality of the Blender open-source 3D creation suite.
What is the severity of CVE-2017-12082?
CVE-2017-12082 has a severity rating of 7.8, which is considered high.
Which software is affected by CVE-2017-12082?
The Blender package versions 2.79.b+dfsg0-7+deb10u1, 2.83.5+dfsg-5+deb11u1, 3.4.1+dfsg-2, and 3.6.2+dfsg-2 are affected. Additionally, Blender version 2.78c and Debian Linux versions 8.0 and 9.0 are also affected.
How can CVE-2017-12082 be exploited?
An attacker can exploit CVE-2017-12082 by crafting a specially crafted external data file in a .blend file, which triggers an integer overflow and leads to a buffer overflow. This can potentially allow the attacker to execute arbitrary code.
How can I fix CVE-2017-12082?
To fix CVE-2017-12082, it is recommended to update your Blender package or Debian Linux to the specified fixed versions: 2.79.b+dfsg0-7+deb10u1, 2.83.5+dfsg-5+deb11u1, 3.4.1+dfsg-2, 3.6.2+dfsg-2, or apply the corresponding security patches provided by Debian.