CVE-2018-25033: Out-of-bounds read in admesh
Summary
CVE-2018-25033: Out-of-bounds read in admesh. Affects admesh versions < 0.98.5. Fixed in 0.98.5. How to fix ↓
Also tracked for
- admesh · Debian:11
The same CVE-2018-25033 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The admesh package is a PyPI package that provides functionality for processing and manipulating 3D mesh files. It is commonly used in various applications that deal with 3D modeling and printing. The vulnerability identified as CVE-2018-25033 is a heap-based buffer over-read in the stl_update_connects_remove_1 function, which is called from stl_remove_degenerate in the connect.c file of the libadmesh.a library. This vulnerability can potentially be exploited by an attacker to read data from outside the bounds of a heap buffer, leading to information disclosure or a denial of service.
Vulnerability Detail
The vulnerability in admesh arises due to improper bounds checking in the stl_update_connects_remove_1 function. When processing certain STL files, this function can read data beyond the allocated buffer, resulting in an out-of-bounds read. This can lead to the exposure of sensitive information or cause the application to crash. The issue has been assigned a CVSS score of 8.1, indicating a high severity level. The Common Weakness Enumeration (CWE) identifier for this vulnerability is CWE-125.
How To Fix
Minimum fixed version
0.98.5
This is the first release that contains the fix.
pip install --upgrade "admesh==0.98.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is highly recommended to update to the latest version of the admesh package as mentioned in the 'how_to_fix' section.
Conclusion
The admesh package is vulnerable to an out-of-bounds read issue in the stl_update_connects_remove_1 function. This vulnerability can potentially lead to information disclosure or denial of service. It is crucial to update the admesh package to version 0.98.5 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for admesh →
FAQ
Admesh is a PyPI package used for processing and manipulating 3D mesh files. It is commonly used in applications related to 3D modeling and printing.
This vulnerability can potentially lead to information disclosure or denial of service. An attacker could exploit the vulnerability to read sensitive data or cause the application to crash.
To fix this vulnerability, update the admesh package to version 0.98.5 or later using the 'pip install --upgrade admesh' command.
There is no specific workaround available for this vulnerability. It is recommended to update to the latest version of the admesh package.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for admesh.
