[Bug 1610822] New: CVE-2017-2902 blender: Integer Overflow in DPX
loading
[epel-7]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1610822
Bug ID: 1610822
Summary: CVE-2017-2902 blender: Integer Overflow in DPX loading
[epel-7]
Product: Fedora EPEL
Version: epel7
Component: blender
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: luya_tfz(a)thefinalzone.net
Reporter: lpardo(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: design-devel(a)lists.fedoraproject.org,
hobbes1069(a)gmail.com, kwizart(a)gmail.com,
luya_tfz(a)thefinalzone.net, negativo17(a)gmail.com,
promac(a)gmail.com
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months
[Bug 1610819] New: CVE-2017-2901 blender:
Integer Overflow in imb_loadiris [epel-7]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1610819
Bug ID: 1610819
Summary: CVE-2017-2901 blender: Integer Overflow in
imb_loadiris [epel-7]
Product: Fedora EPEL
Version: epel7
Component: blender
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: luya_tfz(a)thefinalzone.net
Reporter: lpardo(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: design-devel(a)lists.fedoraproject.org,
hobbes1069(a)gmail.com, kwizart(a)gmail.com,
luya_tfz(a)thefinalzone.net, negativo17(a)gmail.com,
promac(a)gmail.com
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months
[Bug 1610818] New: CVE-2017-2901 blender: Integer Overflow in
imb_loadiris
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1610818
Bug ID: 1610818
Summary: CVE-2017-2901 blender: Integer Overflow in
imb_loadiris
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: design-devel(a)lists.fedoraproject.org,
hobbes1069(a)gmail.com, kwizart(a)gmail.com,
luya_tfz(a)thefinalzone.net, negativo17(a)gmail.com,
promac(a)gmail.com
An exploitable integer overflow exists in the IRIS loading functionality of the
Blender open-source 3d creation suite version 2.78c. A specially crafted
'.iris' file can cause an integer overflow resulting in a buffer overflow which
can allow for code execution under the context of the application. An attacker
can convince a user to use the file as an asset via the sequencer in order to
trigger this vulnerability.
References:
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0408
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months
[Bug 1610812] New: CVE-2017-2899 blender: Integer Overflow in
imb_loadtiff
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1610812
Bug ID: 1610812
Summary: CVE-2017-2899 blender: Integer Overflow in
imb_loadtiff
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: design-devel(a)lists.fedoraproject.org,
hobbes1069(a)gmail.com, kwizart(a)gmail.com,
luya_tfz(a)thefinalzone.net, negativo17(a)gmail.com,
promac(a)gmail.com
An exploitable integer overflow exists in the TIFF loading functionality of the
Blender open-source 3d creation suite version 2.78c. A specially crafted '.tif'
file can cause an integer overflow resulting in a buffer overflow which can
allow for code execution under the context of the application. An attacker can
convince a user to use the file as an asset via the sequencer in order to
trigger this vulnerability.
References:
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0406
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months
[Bug 1610815] New: CVE-2017-2900 blender:
Integer Overflow in IMB_ibImageFromMemory
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1610815
Bug ID: 1610815
Summary: CVE-2017-2900 blender: Integer Overflow in
IMB_ibImageFromMemory
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: design-devel(a)lists.fedoraproject.org,
hobbes1069(a)gmail.com, kwizart(a)gmail.com,
luya_tfz(a)thefinalzone.net, negativo17(a)gmail.com,
promac(a)gmail.com
An exploitable integer overflow exists in the PNG loading functionality of the
Blender open-source 3d creation suite version 2.78c. A specially crafted .png
file can cause an integer overflow resulting in a buffer overflow which can
allow for code execution under the context of the application. An attacker can
convince a user to use the file as an asset via the sequencer in order to
trigger this vulnerability.
References:
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0407
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months
[Bug 1610813] CVE-2017-2899 blender: Integer Overflow in
imb_loadtiff [
epel-7]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1610813
--- Comment #1 from Laura Pardo <lpardo(a)redhat.com> ---
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug. This will ensure that all associated bugs get updated
when new packages are pushed to stable.
=====
# bugfix, security, enhancement, newpackage (required)
type=security
# testing, stable
request=testing
# Bug numbers: 1234,9876
bugs=1610812,1610813
# Description of your update
notes=Security fix for [PUT CVEs HERE]
# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3
# Automatically close bugs when this marked as stable
close_bugs=True
# Suggest that users restart after update
suggest_reboot=False
======
Additionally, you may opt to use the bodhi web interface to submit updates:
https://bodhi.fedoraproject.org/updates/new
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months