CVE-2024-24684
Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. A specially crafted .off file can lead to st...
Original description
The description as published by the source.
Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. A specially crafted .off file can lead to stack-based buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the header parsing occuring while processing an .off file via the readOFF function.
We can see above that at [0] a stack-based buffer called comment is defined with an hardcoded size of 1000 bytes. The call to fscanf at [1] is unsafe and if the first line of the header of the .off files is longer than 1000 bytes it will overflow the header buffer.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Ubuntu UBUNTU-CVE-2024-24684 slic3r-prusa
References
- advisory github.com
- advisory nvd.nist.gov
- web talosintelligence.com
- web talosintelligence.com