Fix cve into assimp #1258
Fix cve into assimp #1258
Conversation
|
@clalancette A friendly ping to follow up on this issue. |
There was a problem hiding this comment.
We should stick with the Ubuntu Noble version https://blueprints.launchpad.net/ubuntu/noble/+source/assimp which is 5.3.1
|
the vulnerability has already been reported on the ubuntu site. https://bugs.launchpad.net/ubuntu/+source/assimp Since this is a security issue, we recommend using the secure version. The version also fixes issues when importing large CAD files. |
In this particular case, because it is a CVE, I think we should consider updating it. That said, the last time we did an update like this we caused a bunch of regressions, so I want to take a closer look before we change anything here. |
Updated assimp .. is need to fix cve https://ubuntu.com/security/CVE-2024-40724 Signed-off-by: mosfet80 <[email protected]>
Fixes CVE-2025-2751: Out-of-bounds Read in Assimp::CSMImporter::InternReadFile Fixes CVE-2025-2757: Heap-based Buffer Overflow in AI_MD5_PARSE_STRING_IN_QUOTATION Fixes CVE-2025-2750: out of bounds write by assigning to wrong array element count tracking fix-CVE-2025-3158: closes #6023 Fixes CVE-2025-3158: Heap-based Buffer Overflow in Assimp::LWO::AnimResolver::UpdateAnimRangeSetup by
Updated assimp .. is need to fix cve https://ubuntu.com/security/CVE-2024-40724
also fix Fixes GHSA-345v-qrhv-w227: Out-of-bounds Read in Assimp::CSMImporter::InternReadFile
Fixes GHSA-4p6w-747g-444c: Heap-based Buffer Overflow in AI_MD5_PARSE_STRING_IN_QUOTATION
Fixes GHSA-6x45-4j6r-r8x8: out of bounds write by assigning to wrong array element count tracking
fix-GHSA-6r79-vpvw-rfjj:
Fixes GHSA-6r79-vpvw-rfjj: Heap-based Buffer Overflow in Assimp::LWO::AnimResolver::UpdateAnimRangeSetup