CVE-2017-2902: Buffer Overflow
First published: Tue Apr 24 2018(Updated: )
An exploitable integer overflow exists in the DPX loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.cin' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.
Credit: talos-cna@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/blender | 2.79.b+dfsg0-7+deb10u1 2.83.5+dfsg-5+deb11u1 3.4.1+dfsg-2 3.6.2+dfsg-2 | |
| Blender Blender | =2.78c | |
| Debian Debian Linux | =8.0 | |
| Debian Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.blender.org/gitweb/gitweb.cgi/blender.git/commit/d30cc1ea0b9ba64d8a1e22105528b6cb8077692c
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0409
- https://security-tracker.debian.org/tracker/CVE-2017-2902
- https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html
- https://www.debian.org/security/2018/dsa-4248
Frequently Asked Questions
What is the vulnerability ID for this exploit?
The vulnerability ID for this exploit is CVE-2017-2902.
What is the severity of CVE-2017-2902?
The severity of CVE-2017-2902 is high with a CVSS score of 7.8.
How does the integer overflow vulnerability in Blender version 2.78c occur?
The integer overflow vulnerability in Blender version 2.78c occurs in the DPX loading functionality when processing a specially crafted '.cin' file.
What can an attacker achieve through this vulnerability?
An attacker can exploit this vulnerability to cause a buffer overflow and potentially execute arbitrary code within the context of the Blender application.
Which versions of Blender and Debian Linux are affected by CVE-2017-2902?
Blender version 2.78c and Debian Linux versions 8.0 and 9.0 are affected by CVE-2017-2902.
- collector/security-tracker-debian
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/severity
- agent/tags
- agent/author
- agent/first-publish-date
- agent/description
- agent/event
- package-manager/debian
- vendor/blender
- canonical/blender blender
- version/blender blender/2.78c
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- version/debian debian linux/9.0