PT-2022-12267 · Unknown+1 · Slic3R Libslic3R+1

Published 2022-03-01 · Updated 2022-03-08 · CVE-2021-44961

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Slic3r libslic3r version 1.3.0 Slic3r libslic3r Master Commit b1a5500

Description A memory leakage flaw exists in the class PerimeterGenerator of Slic3r libslic3r, where specially crafted stl files can exhaust available memory. Additionally, an out-of-bounds read vulnerability exists in the GCode::extrude() functionality, which could lead to information disclosure if a specially crafted stl file is provided.

Recommendations For Slic3r libslic3r version 1.3.0, consider disabling the PerimeterGenerator class until a patch is available to prevent memory exhaustion. For Slic3r libslic3r Master Commit b1a5500, restrict access to the GCode::extrude() functionality to minimize the risk of information disclosure. Avoid using specially crafted stl files with the affected versions of Slic3r libslic3r until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2021-44961

Affected Products

Debian

Slic3R Libslic3R

References · 14

• 🔥 https://hackmd.io/nDT_UKLyRQendxDwil9A4w · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-44961 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-44961 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44961 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-44961 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44961 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44961 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-44961 · Security Note
• https://t.me/cibsecurity/38247 · Telegram Post
• https://t.me/cvenotify/27935 · Telegram Post
• http://slic3r.com · Note
• https://t.me/cvenotify/27519 · Telegram Post
• http://libslic3r.com · Note
• https://t.me/cvenotify/27646 · Telegram Post