SB2024052932 - Multiple vulnerabilities in libigl

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024052932

SB2024052932 - Multiple vulnerabilities in libigl

Published: May 29, 2024 Updated: October 17, 2024

Security Bulletin ID SB2024052932
CSH Severity
High
Patch available
NO
Number of vulnerabilities 17
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 82% Medium 18%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 17 vulnerabilities.


1) Stack-based buffer overflow (CVE-ID: CVE-2023-35953)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the readOFF.cpp functionality within the vertices comment. A remote unauthenticated attacker can use a specially crafted .off file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Improper Validation of Array Index (CVE-ID: CVE-2024-22181)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper array index validation in the readNODE functionality. A remote attacker can use a specially crafted .node file and execute arbitrary code on the target system.


3) Out-of-bounds read (CVE-ID: CVE-2024-24583)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the readMSH functionality within MshLoader::ELEMENT_TRI. A remote attacker can create a specially crafted .msh file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.


4) Out-of-bounds read (CVE-ID: CVE-2024-24584)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the readMSH functionality within MshLoader::ELEMENT_TET. A remote attacker can create a specially crafted .msh file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.


5) Out-of-bounds write (CVE-ID: CVE-2023-49600)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in the PlyFile ply_cast_ascii functionality. A remote attacker can create a specially crafted .ply file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.


6) Stack-based buffer overflow (CVE-ID: CVE-2024-24686)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the readOFF functionality within comments in faces parsing. A remote unauthenticated attacker can use a specially crafted .off file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


7) Stack-based buffer overflow (CVE-ID: CVE-2024-24685)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the readOFF functionality within comments in vertex parsing. A remote unauthenticated attacker can use a specially crafted .off file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


8) Stack-based buffer overflow (CVE-ID: CVE-2024-24684)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the readOFF functionality within header parsing. A remote unauthenticated attacker can use a specially crafted .off file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


9) Stack-based buffer overflow (CVE-ID: CVE-2023-35950)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the readOFF.cpp functionality within the header. A remote unauthenticated attacker can use a specially crafted .off file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


10) Improper Validation of Array Index (CVE-ID: CVE-2024-23948)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper array index validation in the readMSH functionality within igl::MshLoader::parse_nodes (ascii file). A remote attacker can use a specially crafted .msh file and execute arbitrary code on the target system.


11) Stack-based buffer overflow (CVE-ID: CVE-2023-35952)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the readOFF.cpp functionality within the faces comment. A remote unauthenticated attacker can use a specially crafted .off file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


12) Stack-based buffer overflow (CVE-ID: CVE-2023-35951)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the readOFF.cpp functionality within the read vertices tic_tac_toe. A remote unauthenticated attacker can use a specially crafted .off file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


13) Stack-based buffer overflow (CVE-ID: CVE-2023-35949)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the readOFF.cpp functionality within the read faces tic_tac_toe. A remote unauthenticated attacker can use a specially crafted .off file, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


14) Improper Validation of Array Index (CVE-ID: CVE-2024-23949)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper array index validation in the readMSH functionality within igl::MshLoader::parse_node_field (ascii file). A remote attacker can use a specially crafted .msh file and execute arbitrary code on the target system.


15) Improper Validation of Array Index (CVE-ID: CVE-2024-23950)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper array index validation in the readMSH functionality within igl::MshLoader::parse_element_field (binary file). A remote attacker can use a specially crafted .msh file and execute arbitrary code on the target system.


16) Improper Validation of Array Index (CVE-ID: CVE-2024-23947)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper array index validation in the readMSH functionality within igl::MshLoader::parse_nodes (binary file). A remote attacker can use a specially crafted .msh file and execute arbitrary code on the target system.


17) Improper Validation of Array Index (CVE-ID: CVE-2024-23951)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper array index validation in the readMSH functionality within igl::MshLoader::parse_element_field (ascii file). A remote attacker can use a specially crafted .msh file and execute arbitrary code on the target system.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References