SB2024052932 - Multiple vulnerabilities in libigl

Main Vulnerability Database SB2024052932

SB2024052932 - Multiple vulnerabilities in libigl

Published: May 29, 2024 Updated: October 17, 2024

Security Bulletin ID SB2024052932

CSH Severity

High

Patch available

NO

Number of vulnerabilities 17

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 17 secuirty vulnerabilities.

1) Improper Validation of Array Index (CVE-ID: CVE-2024-23948)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper array index validation in the readMSH functionality within igl::MshLoader::parse_nodes (ascii file). A remote attacker can use a specially crafted .msh file and execute arbitrary code on the target system.

2) Improper Validation of Array Index (CVE-ID: CVE-2024-23951)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper array index validation in the readMSH functionality within igl::MshLoader::parse_element_field (ascii file). A remote attacker can use a specially crafted .msh file and execute arbitrary code on the target system.

3) Improper Validation of Array Index (CVE-ID: CVE-2024-23947)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper array index validation in the readMSH functionality within igl::MshLoader::parse_nodes (binary file). A remote attacker can use a specially crafted .msh file and execute arbitrary code on the target system.

4) Improper Validation of Array Index (CVE-ID: CVE-2024-23950)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper array index validation in the readMSH functionality within igl::MshLoader::parse_element_field (binary file). A remote attacker can use a specially crafted .msh file and execute arbitrary code on the target system.

5) Improper Validation of Array Index (CVE-ID: CVE-2024-23949)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper array index validation in the readMSH functionality within igl::MshLoader::parse_node_field (ascii file). A remote attacker can use a specially crafted .msh file and execute arbitrary code on the target system.

6) Stack-based buffer overflow (CVE-ID: CVE-2023-35949)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the readOFF.cpp functionality within the read faces tic_tac_toe. A remote unauthenticated attacker can use a specially crafted .off file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

7) Stack-based buffer overflow (CVE-ID: CVE-2023-35951)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the readOFF.cpp functionality within the read vertices tic_tac_toe. A remote unauthenticated attacker can use a specially crafted .off file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

8) Stack-based buffer overflow (CVE-ID: CVE-2023-35952)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the readOFF.cpp functionality within the faces comment. A remote unauthenticated attacker can use a specially crafted .off file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

9) Stack-based buffer overflow (CVE-ID: CVE-2023-35953)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the readOFF.cpp functionality within the vertices comment. A remote unauthenticated attacker can use a specially crafted .off file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

10) Stack-based buffer overflow (CVE-ID: CVE-2023-35950)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the readOFF.cpp functionality within the header. A remote unauthenticated attacker can use a specially crafted .off file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

11) Stack-based buffer overflow (CVE-ID: CVE-2024-24684)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the readOFF functionality within header parsing. A remote unauthenticated attacker can use a specially crafted .off file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

12) Stack-based buffer overflow (CVE-ID: CVE-2024-24685)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the readOFF functionality within comments in vertex parsing. A remote unauthenticated attacker can use a specially crafted .off file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

13) Stack-based buffer overflow (CVE-ID: CVE-2024-24686)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the readOFF functionality within comments in faces parsing. A remote unauthenticated attacker can use a specially crafted .off file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

14) Out-of-bounds write (CVE-ID: CVE-2023-49600)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in the PlyFile ply_cast_ascii functionality. A remote attacker can create a specially crafted .ply file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.

15) Out-of-bounds read (CVE-ID: CVE-2024-24584)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the readMSH functionality within MshLoader::ELEMENT_TET. A remote attacker can create a specially crafted .msh file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.

16) Out-of-bounds read (CVE-ID: CVE-2024-24583)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the readMSH functionality within MshLoader::ELEMENT_TRI. A remote attacker can create a specially crafted .msh file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.

17) Improper Validation of Array Index (CVE-ID: CVE-2024-22181)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper array index validation in the readNODE functionality. A remote attacker can use a specially crafted .node file and execute arbitrary code on the target system.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References