Średnia

A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue occurs when processing certain malformed MD5 model files, leading to an out-of-bou

Ujawniono: 21.11.2024
Aktualizacja: 11.10.2026 12:19

A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue occurs when processing certain malformed MD5 model files, leading to an out-of-bounds read and potential application crash.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

Platforma	Paczka	Podatne wersje	Poprawka w wersji
Python (PyPI)	pyassimp	<= 5.4.3	brak poprawki

Odnośniki

https://github.com/assimp/assimp/issues/5860

Ocena CVSS 6.2/10

Wektor CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Słabość (CWE): -
Platforma: Python (PyPI)
Paczka: pyassimp
Ujawniono: 21.11.2024
Aktualizacja: 11.10.2026 12:19

Źródła i licencje

OSV / GitHub Advisory Database - PYSEC-2024-295 - PyPA Advisory Database; CC BY 4.0

Historia podatności: pyassimp

Wszystkie opisane podatności tej paczki (Python (PyPI)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (33) w archiwum

Wszystkich wpisów: 33
Pierwsza → ostatnia: 09.2024 10.2025
Bez poprawki: 33
Wykorzystywana w atakach: 0

Rozkład istotności

Krytyczna 1
Wysoka 16
Średnia 14
Niska 2

Ujawnienia w latach

2024: 6
2025: 27
2026: 0

05.10.2025

A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipula

Wysoka · 7.8 CVE-2025-11277 <= 6.0.2 brak poprawki
05.10.2025

A vulnerability was identified in Open Asset Import Library Assimp 6.0.2. Affected by this vulnerability is the function ODDLParser::getNextSeparator in the library assimp/contrib/openddlparser/includ

Wysoka · 7.8 CVE-2025-11275 <= 6.0.2 brak poprawki
03.04.2025

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetL

Wysoka · 7.8 CVE-2025-3159 <= 5.4.3 brak poprawki
03.04.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of t

Wysoka · 7.8 CVE-2025-3158 <= 5.4.3 brak poprawki
31.03.2025

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/

Wysoka · 8.8 CVE-2025-3015 <= 5.4.3 brak poprawki
25.03.2025

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoa

Wysoka · 8.8 CVE-2025-2756 <= 5.4.3 brak poprawki
25.03.2025

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Pa

Wysoka · 8.8 CVE-2025-2757 <= 5.4.3 brak poprawki
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of the file code/AssetLib/LWS/LWSLoader.cpp

Wysoka · 8.8 CVE-2025-2753 <= 5.4.3 brak poprawki
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as critical. Affected by this issue is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/A

Wysoka · 8.8 CVE-2025-2755 <= 5.4.3 brak poprawki
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as critical. Affected by this vulnerability is the function Assimp::AC3DImporter::ConvertObjectSection of the

Wysoka · 8.8 CVE-2025-2754 <= 5.4.3 brak poprawki
25.03.2025

A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the library include/assimp/fast_atof.h of the co

Wysoka · 8.8 CVE-2025-2752 <= 5.4.3 brak poprawki
25.03.2025

A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/Ass

Wysoka · 8.8 CVE-2025-2751 <= 5.4.3 brak poprawki
25.03.2025

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSML

Wysoka · 8.8 CVE-2025-2750 <= 5.4.3 brak poprawki
21.03.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/C

Wysoka · 8.8 CVE-2025-2592 <= 5.4.3 brak poprawki
10.03.2025

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporte

Krytyczna · 9.8 CVE-2025-2152 <= 5.4.3 brak poprawki
10.03.2025

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component F

Wysoka · 8.8 CVE-2025-2151 <= 5.4.3 brak poprawki
21.11.2024

A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue occurs when processing certain malformed MD5 model files, leading to an out-of-bou ten wpis

Średnia · 6.2 CVE-2024-53425 <= 5.4.3 brak poprawki
24.10.2024

An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.

Wysoka · 7.8 CVE-2024-48423 wszystkie wersje brak poprawki

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację