CVE-2018-25033: Heap-based Buffer Over-read in admesh
Summary
CVE-2018-25033: ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a. Affects admesh versions < 0.98.5. Fixed in 0.98.5. How to fix ↓
Also tracked for
- admesh · Debian:11
The same CVE-2018-25033 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ADMesh is a library for processing triangulated solid meshes. It provides various functionalities for analyzing and manipulating 3D models. The vulnerability affects versions of ADMesh up to 0.98.4. The specific issue is a heap-based buffer over-read in the 'stl_update_connects_remove_1' function, which is called from 'stl_remove_degenerate' in 'connect.c' within the 'libadmesh.a' library.
Vulnerability Detail
The heap-based buffer over-read vulnerability in ADMesh can lead to information disclosure or denial of service attacks. An attacker could exploit this vulnerability by crafting a malicious 3D model file that triggers the buffer over-read when processed by an application using the vulnerable ADMesh library. This could potentially result in the disclosure of sensitive information or cause the application to crash.
How To Fix
Minimum fixed version
0.98.5
This is the first release that contains the fix.
pip install --upgrade "admesh==0.98.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the ADMesh package to the latest version as soon as possible.
Conclusion
The heap-based buffer over-read vulnerability in ADMesh can have serious consequences, including information disclosure and denial of service attacks. It is crucial to update the ADMesh package to the latest version (0.98.5 or later) to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for admesh →
FAQ
ADMesh is a library for processing triangulated solid meshes. It provides functionalities for analyzing and manipulating 3D models.
A heap-based buffer over-read vulnerability occurs when a program reads data from a buffer beyond its allocated size in the heap memory. This can lead to information disclosure or denial of service attacks.
An attacker can exploit this vulnerability by crafting a malicious 3D model file that triggers the buffer over-read when processed by an application using the vulnerable ADMesh library.
The vulnerability can result in the disclosure of sensitive information or cause the application to crash, leading to a denial of service.
To fix this vulnerability, update the ADMesh package to version 0.98.5 or later by running the command 'pip install --upgrade admesh'.
References
Related vulnerabilities
Recent vulnerabilities recorded for admesh.
