CVE-2022-0545

An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability, allowing an attacker to leak sensitive information or achieve code execution in the context of the Blender process when a specially crafted image file is loaded. This flaw affects Blender versions prior to 2.83.19, 2.93.8 and 3.1.

References

Affected packages

Git / github.com/blender/blender

Affected ranges

Type: GIT
Repo: https://github.com/blender/blender
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

86c526d2c733e2c3de0222b87cee14bc925ac308

Introduced

0330d1af29c067cf309e4798f5259e01a8c3c668

Fixed

09da7f489ad951eff5fc42f97a8079fafce12a89

Introduced

f1cca3055776be50f59dd4fb6de3018afb53d52c

Fixed

c77597cd0e15f9d7b6f963593b545cc94950eb8d

Affected versions

v3.*

v3.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-0545.json"

vanir_signatures

[
    {
        "id": "CVE-2022-0545-99b905fa",
        "target": {
            "function": "sculpt_undo_geometry_restore_data",
            "file": "source/blender/editors/sculpt_paint/sculpt_undo.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/blender/blender/commit/c77597cd0e15f9d7b6f963593b545cc94950eb8d",
        "digest": {
            "function_hash": "161412462493676655162831838872195101415",
            "length": 979.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2022-0545-9f9ab928",
        "target": {
            "file": "source/blender/editors/sculpt_paint/sculpt_undo.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/blender/blender/commit/c77597cd0e15f9d7b6f963593b545cc94950eb8d",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "124043090402698535792582219829702258639",
                "291399862714107792492370666230809677084",
                "19780911924126066182472616114708630776",
                "52788336479705262444171463252782941809",
                "180136656472081687867564524359903073902",
                "208647502420360741357835349339771405644",
                "331397288112833657229470003807514440165",
                "205577027148405797478355135906222874377"
            ]
        },
        "signature_type": "Line"
    }
]