Fix security issue CVE-2008-1102 / #443934 / SA29818: Blender Radiance RGBE Buffer Overflow

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201311-07 (Blender: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Blender. Please review       the CVE identifier referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

リモートホストは、GLSA-201311-07 で説明されている脆弱性の影響を受けます（Blender：複数の脆弱性）

Blender で複数の脆弱性が発見されました。詳細については、以下で参照されている CVE 識別子を参照してください。
 影響：

リモートの攻撃者が、プロセスの権限で任意のコードを実行する可能性や、サービス拒否状態を引き起こす可能性があります。
 回避策：

現時点で、既知の回避策はありません。

遠端主機受到 GLSA-201311-07 中所述的弱點影響 (Blender：多個弱點)

在 Blender 中發現多個弱點。如需詳細資訊，請檢閱以下參照的 CVE 識別碼。
 影響：

遠端攻擊者可能以處理程序的權限執行任意程式碼，或造成拒絕服務情況。
 因應措施：

目前尚無已知的因應措施。

远程主机受到 GLSA-201311-07 中所述漏洞的影响（Blender：多种漏洞）

在 Blender 中发现多种漏洞。请检查下面引用的 CVE 标识符以了解详细信息。
 影响：

远程攻击者可能以进程的权限执行任意代码，或者造成拒绝服务情况。
 变通方案：

目前无任何已知的变通方案。

It was discovered that Blender did not correctly handle certain malformed Radiance RGBE images. If a user were tricked into opening a .blend file containing a specially crafted Radiance RGBE image, an attacker could execute arbitrary code with the user's privileges.
(CVE-2008-1102)

It was discovered that Blender did not properly sanitize the Python search path. A local attacker could execute arbitrary code by inserting a specially crafted Python file in the Blender working directory. (CVE-2008-4863).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Stefan Cornelius of Secunia Research reported a boundary error when Blender processed RGBE images which could be used to execute arbitrary code with the privileges of the user running Blender if a specially crafted .hdr or .blend file were opened(CVE-2008-1102).

As well, multiple vulnerabilities involving insecure usage of temporary files had also been reported (CVE-2008-1103).

The updated packages have been patched to prevent these issues.

Stefan Cornelius discovered a vulnerability in the Radiance High Dynamic Range (HDR) image parser in Blender, a 3D modelling application. The weakness could enable a stack-based buffer overflow and the execution of arbitrary code if a maliciously-crafted HDR file is opened, or if a directory containing such a file is browsed via Blender's image-open dialog.

The remote host is affected by the vulnerability described in GLSA-200805-12 (Blender: Multiple vulnerabilities)

    Stefan Cornelius (Secunia Research) reported a boundary error within     the imb_loadhdr() function in in the file     source/blender/imbuf/intern/radiance_hdr.c when processing RGBE images     (CVE-2008-1102). Multiple vulnerabilities involving insecure usage of     temporary files have also been reported (CVE-2008-1103).
  Impact :

    A remote attacker could entice a user to open a specially crafted file     (.hdr or .blend), possibly resulting in the remote execution of     arbitrary code with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

ID	名稱	產品	系列	已發布	已更新	嚴重性
32337	Fedora 8 : blender-2.45-14.fc8 (2008-3875)	Nessus	Fedora Local Security Checks	2008/5/16	2021/1/11	medium
70867	GLSA-201311-07 : Blender: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2013/11/13	2021/1/6	high
70867	GLSA-201311-07：Blender：複数の脆弱性	Nessus	Gentoo Local Security Checks	2013/11/13	2021/1/6	high
70867	GLSA-201311-07：Blender：多個弱點	Nessus	Gentoo Local Security Checks	2013/11/13	2021/1/6	high
70867	GLSA-201311-07：Blender：多种漏洞	Nessus	Gentoo Local Security Checks	2013/11/13	2021/1/6	high
32334	Fedora 7 : blender-2.45-14.fc7 (2008-3862)	Nessus	Fedora Local Security Checks	2008/5/16	2021/1/11	medium
37828	Ubuntu 6.06 LTS : blender vulnerabilities (USN-699-1)	Nessus	Ubuntu Local Security Checks	2009/4/23	2021/1/19	medium
36425	Mandriva Linux Security Advisory : blender (MDVSA-2008:204)	Nessus	Mandriva Local Security Checks	2009/4/23	2021/1/6	medium
32141	Debian DSA-1567-1 : blender - buffer overrun	Nessus	Debian Local Security Checks	2008/5/9	2021/1/4	medium
32303	GLSA-200805-12 : Blender: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2008/5/13	2021/1/6	medium

偵測

搜尋 Plugin

medium

high

high

high

high

medium

medium

medium

medium

medium