CVE-2017-2908: Buffer Overflow
An exploitable integer overflow exists in the thumbnail functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to render the thumbnail for the file while in the File->Open dialog.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-2908?
CVE-2017-2908 is an integer overflow vulnerability in the thumbnail functionality of Blender version 2.78c.
What is the severity of CVE-2017-2908?
CVE-2017-2908 has a severity rating of 7.8 (high).
Which software versions are affected by CVE-2017-2908?
The affected software versions are Blender 2.78c, Blender 2.79.b+dfsg0-7+deb10u1, Blender 2.83.5+dfsg-5+deb11u1, Blender 3.4.1+dfsg-2, Blender 3.6.2+dfsg-2.
How can CVE-2017-2908 be exploited?
CVE-2017-2908 can be exploited by a specially crafted .blend file that triggers an integer overflow and leads to a buffer overflow, allowing for code execution.
Is there a fix available for CVE-2017-2908?
Yes, there are remediation steps available in the references provided.