Bug 118163 – media-gfx/blender: buffer overflow (CVE-2005-4470)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Carsten Lohrke (RETIRED) 2006-01-07 05:00:49 UTC]

Stumbled upon the Ubuntu advisory, so we're a bit late.

Heap-based buffer overflow in the get_bhead function in readfile.c in Blender BlenLoader 2.0 through 2.40pre allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a .blend file with a negative bhead.len value, which causes less memory to be allocated than expected, possibly due to an integer overflow.

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4470

[Comment 1 Luca Barbato 2006-01-07 05:21:14 UTC]

the latest blender is available.

[Comment 2 Stefan Cornelius (RETIRED) 2006-01-07 06:16:16 UTC]

arches, pls try to stable 2.40 - thx

[Comment 3 Mark Loeser (RETIRED) 2006-01-07 13:07:28 UTC]

x86 stable

[Comment 4 Tobias Scherbaum (RETIRED) 2006-01-07 13:16:58 UTC]

Luca marked stable for ppc, removing us from CC

[Comment 5 Simon Stelling (RETIRED) 2006-01-08 08:02:14 UTC]

I keep getting 

./usr/share/doc/
./usr/share/doc/blender-2.40/
./usr/share/doc/blender-2.40/COPYING.gz
./usr/share/doc/blender-2.40/INSTALL.gz
./usr/share/doc/blender-2.40/README.gz
>>> Done.
!!! CATEGORY info missing from info chunk, aborting...

here, even after deleting the binpkg generated from FEATURES=buildpkg.. maybe someone else from amd64 can test this? I doubt it is related to blender

[Comment 6 Simon Stelling (RETIRED) 2006-01-10 11:08:52 UTC]

hparker confirmed that it works, so amd64 stable

[Comment 7 Sune Kloppenborg Jeppesen (RETIRED) 2006-01-12 23:22:25 UTC]

GLSA 200601-08