[Bug 1610864] New: CVE-2017-2905 blender: Integer Overflow in the upgrade of a legacy Mesh attribute

https://bugzilla.redhat.com/show_bug.cgi?id=1610864

Bug ID: 1610864
           Summary: CVE-2017-2905 blender: Integer Overflow in the upgrade
                    of a legacy Mesh attribute
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail]

An exploitable integer overflow exists in the upgrade of a legacy Mesh
attribute of the Blender open-source 3d creation suite v2.78c. A specially
crafted .blend file can cause an integer overflow resulting in a buffer
overflow which can allow for code execution under the context of the
application. An attacker can convince a user to open the file or use it as a
library in order to trigger this vulnerability.

References:
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0433

[Bug 1610864] CVE-2017-2905 blender: Integer Overflow in the upgrade of a legacy Mesh attribute

https://bugzilla.redhat.com/show_bug.cgi?id=1610864

Laura Pardo  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1610865

--- Comment #1 from Laura Pardo  ---
Created blender tracking bugs for this issue:

Affects: epel-7 [bug 1610865]

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1610865
[Bug 1610865] CVE-2017-12081 blender: Integer Overflow in the upgrade of a
legacy Mesh attribute [epel-7]