An exploitable integer overflow exists in the upgrade of a legacy Mesh attribute of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use it as a library in order to trigger this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An exploitable integer overflow exists in the upgrade of a legacy Mesh attribute of the Blender open-     source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting     in a buffer overflow which can allow for code execution under the context of the application. An attacker     can convince a user to open the file or use it as a library in order to trigger this vulnerability.
    (CVE-2017-12081)

Note that Nessus relies on the presence of the package as reported by the vendor.

Multiple vulnerabilities have been discovered in various parsers of Blender, a 3D modeller/ renderer. Malformed .blend model files and malformed multimedia files (AVI, BMP, HDR, CIN, IRIS, PNG, TIFF) may result in the execution of arbitrary code.

For Debian 8 'Jessie', these problems have been fixed in version 2.72.b+dfsg0-3+deb8u1.

We recommend that you upgrade your blender packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in various parsers of Blender, a 3D modeller/ renderer. Malformed .blend model files and malformed multimedia files (AVI, BMP, HDR, CIN, IRIS, PNG, TIFF) may result in the execution of arbitrary code.

ID	Name	Product	Family	Severity
254713	Linux Distros Unpatched Vulnerability : CVE-2017-12081	Nessus	Misc.	high
111705	Debian DLA-1465-1 : blender security update	Nessus	Debian Local Security Checks	high
111140	Debian DSA-4248-1 : blender - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-12081

high

Tenable Plugins

high

high

high