Integer Overflow Vulnerability in Blender Open-Source 3D Creation Suite
CVE-2017-2901

8.8HIGH

Key Information:

Vendor

Blender

Status
Blender
Vendor
CVE Published:
24 April 2018

What is CVE-2017-2901?

An exploitable integer overflow in the IRIS loading functionality of Blender allows attackers to use specially crafted '.iris' files to trigger a buffer overflow. This could lead to arbitrary code execution within the context of the application. Users can be manipulated into loading malicious files as assets through the sequencer, putting their systems at risk.

Affected Version(s)

Blender v2.78c

References

https://lists.debian.org/debian-lts-announce/2018/08/msg0...
mailing-listx_refsource_MLIST
https://www.debian.org/security/2018/dsa-4248
vendor-advisoryx_refsource_DEBIAN
https://www.talosintelligence.com/vulnerability_reports/T...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.