Bug 1189704 - (CVE-2020-28589) VUL-0: CVE-2020-28589: tinyobjloader: An improper array index validation could lead to code execution.
(CVE-2020-28589)
VUL-0: CVE-2020-28589: tinyobjloader: An improper array index validation coul...
Status: NEW
Classification: openSUSE
Product: openSUSE Distribution
Classification: openSUSE
Component: Security
Leap 15.2
Other Other
: P3 - Medium : Normal (vote)
: ---
Assigned To: Martin Hauke
Security Team bot
https://smash.suse.de/issue/306377/
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2021-08-23 09:06 UTC by Robert Frohl
Modified: 2021-08-23 09:56 UTC (History)
0 users

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2021-08-23 09:06:50 UTC
rh#1992814

An improper array index validation vulnerability exists in the LoadObj functionality of tinyobjloader v2.0-rc1 and tinyobjloader development commit 79d4421. A specially crafted file could lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

Reference:

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1212

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1992814
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28589
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28589
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1212
Comment 1 Robert Frohl 2021-08-23 09:15:04 UTC
commit from TALOS-2020-1212 seems to point to a cmake version bump ? Not to sure if this is correct.

https://github.com/tinyobjloader/tinyobjloader/commit/79d44219e74836e9151898de8debb2b26e8e7c29
Comment 2 Martin Hauke 2021-08-23 09:47:43 UTC
(In reply to Robert Frohl from comment #1)
> commit from TALOS-2020-1212 seems to point to a cmake version bump ? Not to
> sure if this is correct.
> 
> https://github.com/tinyobjloader/tinyobjloader/commit/
> 79d44219e74836e9151898de8debb2b26e8e7c29

This is the commit they probably meant:
https://github.com/tinyobjloader/tinyobjloader/commit/0ed6c38f20c63b996fbb9fa949569b2acb213a3d
Comment 3 Martin Hauke 2021-08-23 09:56:30 UTC
SR#913734 -> version bump to current master with the fix applied.