CVE-2022-0545: Integer Overflow
An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability, allowing an attacker to leak sensitive information or achieve code execution in the context of the Blender process when a specially crafted image file is loaded. This flaw affects Blender versions prior to 2.83.19, 2.93.8 and 3.1.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-0545.
What is the severity of CVE-2022-0545?
The severity of CVE-2022-0545 is high with a CVSS score of 7.8.
What is the affected software?
The affected software is Blender versions up to 2.83.19, versions between 2.90.0 and 2.93.8, and versions between 3.0.0 and 3.1.0. It also affects Debian Linux versions 10.0 and 11.0 with the Blender package versions 2.79.b+dfsg0-7+deb10u1, 2.83.5+dfsg-5+deb11u1, 3.4.1+dfsg-2, and 3.6.2+dfsg-2.
What is the impact of CVE-2022-0545?
CVE-2022-0545 can lead to a write-what-where vulnerability and an out-of-bounds read vulnerability, potentially allowing an attacker to leak sensitive information or achieve code execution in the context of the Blender process when a specially crafted image file is loaded.
How can I fix CVE-2022-0545?
To fix CVE-2022-0545, it is recommended to update to the latest version of Blender or apply the provided patches from the official Blender website or the Debian security advisory.