An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts curves to polygons. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use the file as a library in order to trigger this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c     converts curves to polygons. A specially crafted .blend file can cause an integer overflow resulting in a     buffer overflow which can allow for code execution under the context of the application. An attacker can     convince a user to open the file or use the file as a library in order to trigger this vulnerability.
    (CVE-2017-12102)

Note that Nessus relies on the presence of the package as reported by the vendor.

Multiple vulnerabilities have been discovered in various parsers of Blender, a 3D modeller/ renderer. Malformed .blend model files and malformed multimedia files (AVI, BMP, HDR, CIN, IRIS, PNG, TIFF) may result in the execution of arbitrary code.

For Debian 8 'Jessie', these problems have been fixed in version 2.72.b+dfsg0-3+deb8u1.

We recommend that you upgrade your blender packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in various parsers of Blender, a 3D modeller/ renderer. Malformed .blend model files and malformed multimedia files (AVI, BMP, HDR, CIN, IRIS, PNG, TIFF) may result in the execution of arbitrary code.

ID	Name	Product	Family	Severity
259089	Linux Distros Unpatched Vulnerability : CVE-2017-12102	Nessus	Misc.	high
111705	Debian DLA-1465-1 : blender security update	Nessus	Debian Local Security Checks	high
111140	Debian DSA-4248-1 : blender - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-12102

high

Tenable Plugins

high

high

high