diff options
author | Salvatore Bonaccorso <carnil@debian.org> | 2022-01-02 22:05:27 +0100 |
---|---|---|
committer | Salvatore Bonaccorso <carnil@debian.org> | 2022-01-02 22:07:36 +0100 |
commit | 48c7393473d9d61458f1bf1a4a5c6687451e02c7 (patch) | |
tree | 94e0da0a295d8cd3deff2593fee79fcd40f2567a | |
parent | 264e40cb48b40c5aa0d12500630161aa79e09fd4 (diff) |
Add CVE-2021-45948/assimp
Note for reviewers: The CVE description and the "oss-fuzz' OSV-2021-775
reference seems wrong in tmarking the affected versions. There is a
related upstream pull request covering various issues, including the
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34416
one which is fixed within
https://github.com/assimp/assimp/commit/3664fe20c07fdbd4d72c5caf68375b056806ab08
and so included in v5.1.0 upstream.
-rw-r--r-- | data/CVE/list.2021 | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/data/CVE/list.2021 b/data/CVE/list.2021 index a7c9a860c7..ddf519c27e 100644 --- a/data/CVE/list.2021 +++ b/data/CVE/list.2021 @@ -106,7 +106,11 @@ CVE-2021-45949 (Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34675 NOTE: https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=2a3129365d3bc0d4a41f107ef175920d1505d1f7 CVE-2021-45948 (Open Asset Import Library (aka assimp) 5.1.0 and 5.1.1 has a heap-base ...) - TODO: check + - assimp 5.1.1~ds0-1 + NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34416 + NOTE: https://github.com/google/oss-fuzz-vulns/blob/main/vulns/assimp/OSV-2021-775.yaml + NOTE: https://github.com/assimp/assimp/pull/4146 + NOTE: https://github.com/assimp/assimp/commit/30f17aa2064b86c0096f0ec701b9e8ea9312fef2 (v5.1.0) CVE-2021-45947 (Wasm3 0.5.0 has an out-of-bounds write in Runtime_Release (called from ...) TODO: check CVE-2021-45946 (Wasm3 0.5.0 has an out-of-bounds write in CompileBlock (called from Co ...) |