CVE-2005-4470 Heap-based buffer overflow in the get_bhead function in readfile.c in Blender BlenLoader 2.0 through 2.40pre allows remote attackers to cause a denial of service (application crash) and possibly execu...
HighCVSS 7.5
EPSS 5.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in the get_bhead function in readfile.c in Blender BlenLoader 2.0 through 2.40pre allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a .blend file with a negative bhead.len value, which causes less memory to be allocated than expected, possibly due to an integer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| blender blenloader | <= 2.40_pre | No fix listed |
| blender blenloader | = 2.0 | No fix listed |
| blender blenloader | = 2.04 | No fix listed |
| blender blenloader | = 2.25 | No fix listed |
| blender blenloader | = 2.26 | No fix listed |
| blender blenloader | = 2.27 | No fix listed |
| blender blenloader | = 2.28 | No fix listed |
| blender blenloader | = 2.28a | No fix listed |
| blender blenloader | = 2.28c | No fix listed |
| blender blenloader | = 2.30 | No fix listed |
| blender blenloader | = 2.31a | No fix listed |
| blender blenloader | = 2.32 | No fix listed |
| blender blenloader | = 2.33 | No fix listed |
| blender blenloader | = 2.33a | No fix listed |
| blender blenloader | = 2.34 | No fix listed |
| blender blenloader | = 2.35 | No fix listed |
| blender blenloader | = 2.37 | No fix listed |
| blender blenloader | = 2.37a | No fix listed |
| blender blenloader | = 2.39 | No fix listed |
| blender blenloader | = 2.40_alpha | No fix listed |
| debian/blender(Debian:12) | < 2.40-1 | 2.40-1 |
| debian/blender(Debian:13) | < 2.40-1 | 2.40-1 |
| debian/blender(Debian:14) | < 2.40-1 | 2.40-1 |
References
- 18176 third-party-advisory vendor-advisory
- 18178 third-party-advisory
- 18452 third-party-advisory
- 19754 third-party-advisory
- DSA-1039 vendor-advisory
- GLSA-200601-08 vendor-advisory
- www.overflow.pl exploit
- 20051220 [Overflow.pl] Blender BlenLoader Integer Overflow mailing-list
- 15981 exploit vdb-entry
- ADV-2005-3032 vdb-entry
- USN-238-2 vendor-advisory
- Debian Security Tracker CVE-2005-4470 vendor-advisory
- bugs.debian.org issue-tracking