Heap-based buffer overflow in assimp - CVE-2024-40724

Vulnerability identifier: #VU94525

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-40724

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can use a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

assimp
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Package Hub 15
Desktop Applications Module
openSUSE Leap
openEuler
assimp-help
assimp-debuginfo
assimp
python3-assimp
assimp-devel
assimp-debugsource
libQt53DInput5-debuginfo
libqt5-qt3d-tools
libQt53DQuickRender-devel
libQt53DQuickInput5
libQt53DQuick-devel
libQt53DQuickRender5
libQt53DLogic-devel
libQt53DQuickScene2D5
libQt53DRender5
libQt53DQuickScene2D5-debuginfo
libqt5-qt3d-tools-debuginfo
libQt53DQuickExtras-devel
libQt53DExtras-devel
libQt53DAnimation5
libqt5-qt3d-devel
libQt53DQuick5
libQt53DInput5
libQt53DRender-devel
libQt53DQuickAnimation-devel
libQt53DQuickExtras5
libqt5-qt3d-private-headers-devel
libQt53DQuickAnimation5
libqt5-qt3d-debugsource
libQt53DCore5-debuginfo
libQt53DAnimation5-debuginfo
libQt53DCore5
libQt53DQuickExtras5-debuginfo
libQt53DQuickInput-devel
libQt53DQuickInput5-debuginfo
libQt53DAnimation-devel
libqt5-qt3d-imports-debuginfo
libQt53DExtras5
libQt53DQuickRender5-debuginfo
libQt53DQuickScene2D-devel
libQt53DExtras5-debuginfo
libQt53DRender5-debuginfo
libQt53DLogic5
libQt53DCore-devel
libqt5-qt3d-imports
libQt53DInput-devel
libQt53DQuickAnimation5-debuginfo
libQt53DQuick5-debuginfo
libQt53DLogic5-debuginfo
libqt5-qt3d-examples
libqt5-qt3d-examples-debuginfo
libqt5-qt3d-debuginfo
libqt5-qtquick3d-debugsource
libQt5Quick3DAssetImport5-debuginfo
libqt5-qtquick3d-tools-debuginfo
libqt5-qtquick3d-imports-debuginfo
libqt5-qtquick3d-tools
libqt5-qtquick3d-private-headers-devel
libqt5-qtquick3d-examples-debuginfo
libQt5Quick3DAssetImport5
libQt5Quick3D5
libqt5-qtquick3d-imports
libqt5-qtquick3d-examples
libqt5-qtquick3d-debuginfo
libQt5Quick3D5-debuginfo
libqt5-qtquick3d-devel

Install updates from vendor's website.

assimp - update to 5.4.2
assimp-help - addressed in versions 5.2.4-2, 5.3.1-3
assimp-debuginfo - addressed in versions 5.2.4-2, 5.3.1-3
assimp - addressed in versions 5.2.4-2, 5.3.1-3
python3-assimp - addressed in versions 5.2.4-2, 5.3.1-3
assimp-devel - addressed in versions 5.2.4-2, 5.3.1-3
assimp-debugsource - addressed in versions 5.2.4-2, 5.3.1-3
libQt53DInput5-debuginfo - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libqt5-qt3d-tools - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DQuickRender-devel - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DQuickInput5 - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DQuick-devel - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DQuickRender5 - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DLogic-devel - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DQuickScene2D5 - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DRender5 - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DQuickScene2D5-debuginfo - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libqt5-qt3d-tools-debuginfo - update to 5.12.7-150200.4.3.1
libQt53DQuickExtras-devel - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DExtras-devel - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DAnimation5 - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libqt5-qt3d-devel - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DQuick5 - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DInput5 - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DRender-devel - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DQuickAnimation-devel - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DQuickExtras5 - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libqt5-qt3d-private-headers-devel - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DQuickAnimation5 - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libqt5-qt3d-debugsource - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DCore5-debuginfo - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DAnimation5-debuginfo - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DCore5 - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DQuickExtras5-debuginfo - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DQuickInput-devel - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DQuickInput5-debuginfo - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DAnimation-devel - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libqt5-qt3d-imports-debuginfo - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DExtras5 - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DQuickRender5-debuginfo - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DQuickScene2D-devel - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DExtras5-debuginfo - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DRender5-debuginfo - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DLogic5 - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DCore-devel - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libqt5-qt3d-imports - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DInput-devel - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DQuickAnimation5-debuginfo - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DQuick5-debuginfo - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libQt53DLogic5-debuginfo - addressed in versions 5.12.7-150200.4.3.1, 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libqt5-qt3d-examples - addressed in versions 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libqt5-qt3d-examples-debuginfo - addressed in versions 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libqt5-qt3d-debuginfo - addressed in versions 5.15.2+kde39-150400.3.3.1, 5.15.8+kde0-150500.3.3.1, 5.15.12+kde0-150600.3.3.1
libqt5-qtquick3d-debugsource - addressed in versions 5.15.8+kde1-150500.3.3.1, 5.15.12+kde1-150600.3.3.1
libQt5Quick3DAssetImport5-debuginfo - addressed in versions 5.15.8+kde1-150500.3.3.1, 5.15.12+kde1-150600.3.3.1
libqt5-qtquick3d-tools-debuginfo - addressed in versions 5.15.8+kde1-150500.3.3.1, 5.15.12+kde1-150600.3.3.1
libqt5-qtquick3d-imports-debuginfo - addressed in versions 5.15.8+kde1-150500.3.3.1, 5.15.12+kde1-150600.3.3.1
libqt5-qtquick3d-tools - addressed in versions 5.15.8+kde1-150500.3.3.1, 5.15.12+kde1-150600.3.3.1
libqt5-qtquick3d-private-headers-devel - addressed in versions 5.15.8+kde1-150500.3.3.1, 5.15.12+kde1-150600.3.3.1
libqt5-qtquick3d-examples-debuginfo - addressed in versions 5.15.8+kde1-150500.3.3.1, 5.15.12+kde1-150600.3.3.1
libQt5Quick3DAssetImport5 - addressed in versions 5.15.8+kde1-150500.3.3.1, 5.15.12+kde1-150600.3.3.1
libQt5Quick3D5 - addressed in versions 5.15.8+kde1-150500.3.3.1, 5.15.12+kde1-150600.3.3.1
libqt5-qtquick3d-imports - addressed in versions 5.15.8+kde1-150500.3.3.1, 5.15.12+kde1-150600.3.3.1
libqt5-qtquick3d-examples - addressed in versions 5.15.8+kde1-150500.3.3.1, 5.15.12+kde1-150600.3.3.1
libqt5-qtquick3d-debuginfo - addressed in versions 5.15.8+kde1-150500.3.3.1, 5.15.12+kde1-150600.3.3.1
libQt5Quick3D5-debuginfo - addressed in versions 5.15.8+kde1-150500.3.3.1, 5.15.12+kde1-150600.3.3.1
libqt5-qtquick3d-devel - addressed in versions 5.15.8+kde1-150500.3.3.1, 5.15.12+kde1-150600.3.3.1

• https://jvn.jp/en/jp/JVN87710540/index.html

• Heap-based buffer overflow in Assimp
• openEuler 24.03 LTS update for assimp
• openEuler 22.03 LTS SP4 update for assimp
• openEuler 22.03 LTS SP3 update for assimp
• openEuler 22.03 LTS SP1 update for assimp
• SUSE update for libqt5-qt3d
• SUSE update for libqt5-qt3d
• SUSE update for libqt5-qt3d
• SUSE update for libqt5-qtquick3d
• SUSE update for libqt5-qtquick3d
• SUSE update for libqt5-qt3d