Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2018-25033: Adobe Mesh Importer 0.98.4 Heap Overflow Risk
CVE-2018-25033 · published 4 years ago
Summary
Adobe Mesh Importer versions 0.98.4 and below contain a bug that could allow an attacker to potentially cause the program to crash or behave unexpectedly. This issue affects users who work with 3D models and import them using the Adobe Mesh Importer. To stay secure, update to the latest version of the software.
What to do
- Update miro hrončok admesh to version 0.98.5.
- Update debian admesh to version 0.98.4-2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | miro hrončok | admesh |
< 0.98.5 Fix: upgrade to 0.98.5
|
| – | admesh_project | admesh |
<= 0.98.4 cpe:2.3:a:admesh_project:admesh:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
9.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | admesh | All versions |
| Debian:12 | debian | admesh |
< 0.98.4-2 Fix: upgrade to 0.98.4-2
|
Original advisory text
ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a.
ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a.
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-25033
- https://github.com/advisories/GHSA-5jrq-582v-9767
- https://github.com/pypa/advisory-database/tree/main/vulns/admesh/PYSEC-2022-182....
- https://github.com/admesh/admesh/issues/28 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/05/msg00029.html Vendor Advisory
- https://ubuntu.com/security/CVE-2018-25033 Third Party Advisory
- https://github.com/admesh/admesh/commit/e84d8353f1347e1f26f0a95770d92ba14e6ede38 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2018-25033 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2018-25033 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-125Out-of-bounds Read
Timeline
Published8 May 2022
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-5jrq-582v-9767 · GHSA
CVE-2018-25033 · NVD
UBUNTU-CVE-2018-25033 · OSV
CVE-2018-25033 · OSV
DEBIAN-CVE-2018-25033 · OSV
Track software like this
Free during beta