Skip to content
OpenAdvisories
High · 8.8 CVE-2017-12103 EUVD-2017-3687GHSA-vh9r-67m7-9p26

An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts text rendered as a font in…

Published Apr 24, 2018 · Updated Sep 16, 2024 · Assigned by talos

Description

An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts text rendered as a font into a curve. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.

Affected products

VendorProductAffectedFixed
Blender Blender v2.78c —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 blender 2.79.a+dfsg0-1 —
Debian 13 blender 2.79.a+dfsg0-1 —
Debian 12 blender 2.79.a+dfsg0-1 —
Debian 9 blender 2.79.b+dfsg0-1~deb9u1 DSA-4248-1
Debian 8 blender 2.72.b+dfsg0-3+deb8u1 DLA-1465-1
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS blender No fix yet —

Advisories 2

References