Multiple vulnerabilities have been discovered in Blender, the worst of which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/blender | * | < 3.1.0 | >= 3.1.0 |
Blender is a 3D Creation/Animation/Publishing System.
Multiple vulnerabilities have been discovered in Blender. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Blender users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/blender-3.1.0"
Multiple vulnerabilities have been found in Blender, the worst of which could allow attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/blender | * | < 2.49b-r2 | >= 2.49b-r2 |
Blender is a 3D Creation/Animation/Publishing System.
Multiple vulnerabilities have been discovered in Blender. Please review the CVE identifier referenced below for details.
A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition.
There is no known workaround at this time.
All Blender users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/blender-2.49b-r2"
An untrusted search path vulnerability in Blender might result in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/blender | * | < 2.48a-r3 | >= 2.48a-r3 |
Blender is a 3D Creation/Animation/Publishing System.
Steffen Joeris reported that Blender's BPY_interface calls PySys_SetArgv() in such a way that Python prepends sys.path with an empty string.
A local attacker could entice a user to run "blender" from a directory containing a specially crafted Python module, resulting in the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All Blender users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/blender-2.48a-r3"
Multiple vulnerabilities in Blender might result in the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/blender | * | < 2.43-r2 | >= 2.43-r2 |
Blender is a 3D creation, animation and publishing program.
Stefan Cornelius (Secunia Research) reported a boundary error within the imb_loadhdr() function in in the file source/blender/imbuf/intern/radiance_hdr.c when processing RGBE images (CVE-2008-1102). Multiple vulnerabilities involving insecure usage of temporary files have also been reported (CVE-2008-1103).
A remote attacker could entice a user to open a specially crafted file (.hdr or .blend), possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All Blender users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/blender-2.43-r2"
A vulnerability has been discovered in Blender allowing for user-assisted arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/blender | * | < 2.43 | >= 2.43 |
Blender is a 3D creation, animation and publishing program.
Stefan Cornelius of Secunia Research discovered an insecure use of the "eval()" function in kmz_ImportWithMesh.py.
A remote attacker could entice a user to open a specially crafted Blender file (.kmz or .kml), resulting in the execution of arbitrary Python code with the privileges of the user running Blender.
There is no known workaround at this time.
All Blender users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/blender-2.43"
Blender is vulnerable to a buffer overflow that may be exploited by attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/blender | * | < 2.40 | >= 2.40 |
Blender is an open source software for 3D modeling, animation, rendering, post-production, interactive creation and playback.
Damian Put has reported a flaw due to an integer overflow in the "get_bhead()" function, leading to a heap overflow when processing malformed ".blend" files.
A remote attacker could entice a user into opening a specially crafted ".blend" file, resulting in the execution of arbitrary code with the permissions of the user running Blender.
There is no known workaround at this time.
All Blender users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/blender-2.40"