PT-2022-12435 · Slic3R+1 · Libslic3R+1

Eldstal · Published 2022-01-25 · Updated 2022-01-28 · CVE-2021-45847

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Slic3r libslic3r version 1.3.0

Description The issue is related to several missing input validations in the 3MF parser component of Slic3r libslic3r. This can allow an attacker to cause an application crash using a crafted 3MF input file.

Recommendations For Slic3r libslic3r version 1.3.0, consider disabling the 3MF parser component until a patch is available to prevent potential application crashes from crafted 3MF input files.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2021-45847

Affected Products

Debian

Libslic3R

References · 11

• https://github.com/slic3r/Slic3r/issues/5118 · Patch
• https://github.com/slic3r/Slic3r/issues/5120 · Patch
• https://github.com/slic3r/Slic3r/issues/5119 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-45847 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-45847 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45847 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-45847 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45847 · Security Note
• https://ubuntu.com/security/CVE-2021-45847 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-45847 · Security Note
• https://t.me/cibsecurity/36212 · Telegram Post