CVE-2022-0545

An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability, allowing an attacker to leak sensitive information or achieve code execution in the context of the Blender process when a specially crafted image file is loaded. This flaw affects Blender versions prior to 2.83.19, 2.93.8 and 3.1.

References

Affected packages

Git / github.com/blender/blender

Affected ranges

Type

GIT

Repo

https://github.com/blender/blender

Events

Introduced

Fixed

86c526d2c733e2c3de0222b87cee14bc925ac308

Introduced

0330d1af29c067cf309e4798f5259e01a8c3c668

Fixed

09da7f489ad951eff5fc42f97a8079fafce12a89

Introduced

f1cca3055776be50f59dd4fb6de3018afb53d52c

Fixed

c77597cd0e15f9d7b6f963593b545cc94950eb8d

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.83.19"
        },
        {
            "introduced": "2.90.0"
        },
        {
            "fixed": "2.93.8"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.1.0"
        }
    ]
}

Affected versions

v3.*

v3.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-0545.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "11.0"
            }
        ]
    }
]

vanir_signatures

[
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "161412462493676655162831838872195101415",
            "length": 979.0
        },
        "source": "https://github.com/blender/blender/commit/c77597cd0e15f9d7b6f963593b545cc94950eb8d",
        "id": "CVE-2022-0545-99b905fa",
        "target": {
            "file": "source/blender/editors/sculpt_paint/sculpt_undo.c",
            "function": "sculpt_undo_geometry_restore_data"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "124043090402698535792582219829702258639",
                "291399862714107792492370666230809677084",
                "19780911924126066182472616114708630776",
                "52788336479705262444171463252782941809",
                "180136656472081687867564524359903073902",
                "208647502420360741357835349339771405644",
                "331397288112833657229470003807514440165",
                "205577027148405797478355135906222874377"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/blender/blender/commit/c77597cd0e15f9d7b6f963593b545cc94950eb8d",
        "id": "CVE-2022-0545-9f9ab928",
        "target": {
            "file": "source/blender/editors/sculpt_paint/sculpt_undo.c"
        }
    }
]