PT-2007-2674 · Blender · Kmz Importwithmesh.Py Script+1

Publicado 2007-03-03 · Atualizado 2017-07-29 · CVE-2007-1253

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Blender versions prior to 2.43 kmz ImportWithMesh.py Script for Blender version 0.1.9h

Description The issue allows user-assisted remote attackers to execute arbitrary Python code by importing a crafted KML or KMZ file. This is related to an eval injection vulnerability in the kmz ImportWithMesh.py Script for Blender.

Recommendations For Blender versions prior to 2.43, update to version 2.43 or later to resolve the issue. For kmz ImportWithMesh.py Script for Blender version 0.1.9h, consider disabling the script until a patched version is available.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-1253

Produtos afetados

Blender

Kmz Importwithmesh.Py Script

Referências · 15

• http://secunia.com/secunia_research/2007-40/advisory · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/0798 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1253 · Nota de Segurança
• http://secunia.com/advisories/24232 · Nota
• http://securityfocus.com/bid/22770 · Nota
• https://osv.dev/vulnerability/CVE-2007-1253 · Aviso do Fabricante
• http://securitytracker.com/id?1017714 · Nota
• http://secunia.com/advisories/24233 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-1253 · Aviso do Fabricante
• http://secunia.com/advisories/24991 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32778 · Nota
• https://security-tracker.debian.org/tracker/CVE-2007-1253 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200704-19.xml · Aviso do Fabricante
• http://secunia.com/secunia_research/2007-39/advisory · Aviso do Fabricante
• http://osvdb.org/33836 · Nota