Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0271 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-48425:
    A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode     function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a     read access violation at address 0x000000000460, which points to the zero page, indicating a null or     invalid pointer dereference.

    CVE-2024-40724:
    Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to     execute arbitrary code by inputting a specially crafted file into the product.

    CVE-2024-48424:
    A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function     within the Assimp library, specifically during the processing of OpenGEX files.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to
    execute arbitrary code by inputting a specially crafted file into the product. (CVE-2024-40724)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to     execute arbitrary code by inputting a specially crafted file into the product. (CVE-2024-40724)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3079-1 advisory.

    - CVE-2024-40724: Fixed heap-based buffer overflow in the PLY importer class in assimp (bsc#1228204)

    Other fixes:
    - Check for a nullptr returned from the shader manager
    - Fill image with transparency by default to avoid having junk if it's not filled properly before the     first paint call
    - Fix QTextureAtlas parenting that could lead to crashes due to being used after free'd.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3078-1 advisory.

    - CVE-2024-40724: Fixed heap-based buffer overflow in the PLY importer class in assimp (bsc#1228199)

    Other fixes:
    - Fix progressive anti-aliasing, which doesn't work if any object in the scene used a PrincipledMaterial
    - Skip processing unknown uniforms, such as those that are vendor specific:

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:2985-1 advisory.

    - CVE-2024-40724: Fixed a heap-based buffer overflow in the PLY importer class (bsc#1228199)
    - Fixed progressive anti-aliasing, which doesn't work if any object in the scene used a     PrincipledMaterial
    - Fixed a crash when a custom material/effect shader variable changes
    - Skipped processing unknown uniforms, as those that are vendor specific

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2976-1 advisory.

    - CVE-2024-40724: Fixed heap-based buffer overflow in the PLY importer class in assimp (bsc#1228204)

    Other fixes:
    - Check for a nullptr returned from the shader manager
    - Fill image with transparency by default to avoid having junk if it's not filled properly before the     first paint call
    - Fix QTextureAtlas parenting that could lead to crashes due to being used after free'd.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2984-1 advisory.

    - CVE-2024-40724: Fixed a heap-based buffer overflow in the PLY importer class (bsc#1228204)
    - Checked for a nullptr returned from the shader manager
    - Fill image with transparency by default to avoid having junk if it's not filled properly before the     first paint call
    - Fixed QTextureAtlas parenting that could lead to crashes due to being used after free'd

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2975-1 advisory.

    - CVE-2024-40724: Fixed heap-based buffer overflow in the PLY importer class in assimp (bsc#1228204)

    Other fixes:
    - Check for a nullptr returned from the shader manager
    - Fill image with transparency by default to avoid having junk if it's not filled properly before the     first paint call
    - Fix QTextureAtlas parenting that could lead to crashes due to being used after free'd.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0225-1 advisory.

    - CVE-2024-40724: Fixed heap-based buffer overflow in the PLY importer class (boo#1228142),

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
238630	TencentOS Server 4: assimp (TSSA-2025:0271)	Nessus	Tencent Local Security Checks	high
425971	Alpine: multiple assimp packages: security update to 5.4.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
425971	Alpine: multiple assimp packages: security update to 5.4.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
229233	Linux Distros Unpatched Vulnerability : CVE-2024-40724	Nessus	Misc.	high
206440	SUSE SLED15: libQt53DAnimation-devel / libQt53DAnimation5 / libQt53DCore-devel / etc (SUSE-SU-2024:3079-1)	Nessus	SuSE Local Security Checks	high
206436	SUSE SLES15: libQt5Quick3D5 / libQt5Quick3DAssetImport5 / libqt5-qtquick3d-devel / etc (SUSE-SU-2024:3078-1)	Nessus	SuSE Local Security Checks	high
206000	SUSE SLES15 Security Update : libqt5-qtquick3d (SUSE-SU-2024:2985-1)	Nessus	SuSE Local Security Checks	high
205999	SUSE SLES15: libQt53DAnimation-devel / libQt53DAnimation5 / libQt53DCore-devel / etc (SUSE-SU-2024:2976-1)	Nessus	SuSE Local Security Checks	high
205998	SUSE SLED15: libQt53DAnimation-devel / libQt53DAnimation5 / libQt53DCore-devel / etc (SUSE-SU-2024:2984-1)	Nessus	SuSE Local Security Checks	high
205993	SUSE SLES15: libQt53DAnimation-devel / libQt53DAnimation5 / libQt53DCore-devel / etc (SUSE-SU-2024:2975-1)	Nessus	SuSE Local Security Checks	high
204824	openSUSE 15 Security Update : assimp (openSUSE-SU-2024:0225-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2024-40724

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high