PT-2021-11560 · Slic3R+2 · Slic3R+2

Lilith >_> · Published 2021-04-13 · Updated 2022-08-24 · CVE-2020-28590

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Slic3r libslic3r version 1.3.0 Slic3r libslic3r Master Commit 92abbc42

Description: An out-of-bounds read issue exists in the TriangleMesh::TriangleMesh() functionality when handling obj files. This could lead to information disclosure if a specially crafted obj file is provided by an attacker.

Recommendations: For Slic3r libslic3r version 1.3.0, consider avoiding the use of the TriangleMesh::TriangleMesh() function with untrusted obj files until a fix is available. For Slic3r libslic3r Master Commit 92abbc42, restrict the processing of obj files to trusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

RCE

Weakness Enumeration

CWE-125

CWE-20

Related Identifiers

CVE-2020-28590

Affected Products

Debian

Slic3R

Libslic3R

References · 9

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1213 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2020-28590 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-28590 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-28590 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-28590 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28590 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-28590 · Vendor Advisory
• https://t.me/cvenotify/35091 · Telegram Post