[Git][security-tracker-team/security-tracker][master] Add CVE-2021-45948/assimp

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
41e55805 by Salvatore Bonaccorso at 2022-01-02T22:07:36+01:00
Add CVE-2021-45948/assimp

Note for reviewers: The CVE description and the "oss-fuzz' OSV-2021-775
reference seems wrong in tmarking the affected versions. There is a
related upstream pull request covering various issues, including the

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34416

one which is fixed within

https://github.com/assimp/assimp/commit/3664fe20c07fdbd4d72c5caf68375b056806ab08

and so included in v5.1.0 upstream.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -118,7 +118,11 @@ CVE-2021-45949 (Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer
 	NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34675
 	NOTE: https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=2a3129365d3bc0d4a41f107ef175920d1505d1f7
 CVE-2021-45948 (Open Asset Import Library (aka assimp) 5.1.0 and 5.1.1 has a heap-base ...)
-	TODO: check
+	- assimp 5.1.1~ds0-1
+	NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34416
+	NOTE: https://github.com/google/oss-fuzz-vulns/blob/main/vulns/assimp/OSV-2021-775.yaml
+	NOTE: https://github.com/assimp/assimp/pull/4146
+	NOTE: https://github.com/assimp/assimp/commit/30f17aa2064b86c0096f0ec701b9e8ea9312fef2 (v5.1.0)
 CVE-2021-45947 (Wasm3 0.5.0 has an out-of-bounds write in Runtime_Release (called from ...)
 	TODO: check
 CVE-2021-45946 (Wasm3 0.5.0 has an out-of-bounds write in CompileBlock (called from Co ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/41e5580527b62af40ddfd2674dad9fc20b5529ed

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/41e5580527b62af40ddfd2674dad9fc20b5529ed
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20220102/c2082547/attachment.htm>