CVE-2024-48425
published 2024-10-24CVE-2024-48425: A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.24%
14.9th percentile
A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| assimp | assimp | — | — |
| assimp | assimp | >= 0 < 6.0.2+ds-1 | 6.0.2+ds-1 |
| debian | assimp | < assimp 6.0.2+ds-1 (forky) | assimp 6.0.2+ds-1 (forky) |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
assimp: SEGV in Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode
vendor_redhat·2024-10-24·CVSS 5.5
CVE-2024-48425 [MEDIUM] CWE-122 assimp: SEGV in Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode
assimp: SEGV in Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode
A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.
A flaw was found in the Assimp asset import library. An attacker may be able to trigger a segmentation fault using specially-crafted 3D model files. This can result in a denial of service due to invalid memory access.
Statement: This vulnerability is considered moderate rather than important because it leads to a segmentation fault (application crash) due to a null pointer dereference, but
Debian
CVE-2024-48425: assimp - A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_...
vendor_debian·2024·CVSS 5.5
CVE-2024-48425 [MEDIUM] CVE-2024-48425: assimp - A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_...
A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 6.0.2+ds-1)
sid: resolved (fixed in 6.0.2+ds-1)
trixie: open
GHSA
GHSA-5qr5-9jfv-96j2: A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz te
ghsa_unreviewed·2024-10-24
CVE-2024-48425 [MEDIUM] CWE-120 GHSA-5qr5-9jfv-96j2: A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz te
A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.
OSV
CVE-2024-48425: A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz te
osv·2024-10-24·CVSS 5.5
CVE-2024-48425 [MEDIUM] CVE-2024-48425: A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz te
A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.
No detection rules found.
No public exploits indexed.
2024-10-24
Published