Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2017-2904: Blender 3D Creation Suite: Integer Overflow in HDR File Loading
CVE-2017-2904 · published 8 years ago
Summary
An attacker can trick a user into loading a specially crafted HDR image file into Blender, which could allow the attacker to execute malicious code on the user's computer. This is a concern for Blender users who work with HDR files, as it could lead to unauthorized access to their system. Users should be cautious when opening HDR files from unknown sources and ensure they have the latest version of Blender installed.
What to do
- Update debian blender to version 2.79.a+dfsg0-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | blender |
< 2.79.a+dfsg0-1 Fix: upgrade to 2.79.a+dfsg0-1
|
| Debian:12 | debian | blender |
< 2.79.a+dfsg0-1 Fix: upgrade to 2.79.a+dfsg0-1
|
| Debian:13 | debian | blender |
< 2.79.a+dfsg0-1 Fix: upgrade to 2.79.a+dfsg0-1
|
| Debian:14 | debian | blender |
< 2.79.a+dfsg0-1 Fix: upgrade to 2.79.a+dfsg0-1
|
| – | blender | blender |
2.78c cpe:2.3:a:blender:blender:2.78c:*:*:*:*:*:*:* |
| – | debian | debian_linux |
8.0 9.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
Original advisory text
An exploitable integer overflow exists in the RADIANCE loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.hdr' file can cause an integer overflo...
An exploitable integer overflow exists in the RADIANCE loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.hdr' file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to use the file as an asset via the sequencer in order to trigger this vulnerability.
References
- https://security-tracker.debian.org/tracker/CVE-2017-2904 Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html Mailing List Third Party Advisory
- https://www.debian.org/security/2018/dsa-4248 Third Party Advisory
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0411 Exploit Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-190Integer Overflow
Timeline
Published24 Apr 2018
Updated3 Nov 2026
First seen28 Jul 2026
Track software like this
Free during beta