Heap-based buffer overflow in the get_bhead function in readfile.c in Blender BlenLoader 2.0 through 2.40pre allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a .blend file with a negative bhead.len value, which causes less memory to be allocated than expected, possibly due to an integer overflow.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Blenloader | Blender | * | 2.40_pre (including) |
| Blenloader | Blender | 2.0 (including) | 2.0 (including) |
| Blenloader | Blender | 2.04 (including) | 2.04 (including) |
| Blenloader | Blender | 2.25 (including) | 2.25 (including) |
| Blenloader | Blender | 2.26 (including) | 2.26 (including) |
| Blenloader | Blender | 2.27 (including) | 2.27 (including) |
| Blenloader | Blender | 2.28 (including) | 2.28 (including) |
| Blenloader | Blender | 2.28a (including) | 2.28a (including) |
| Blenloader | Blender | 2.28c (including) | 2.28c (including) |
| Blenloader | Blender | 2.30 (including) | 2.30 (including) |
| Blenloader | Blender | 2.31a (including) | 2.31a (including) |
| Blenloader | Blender | 2.32 (including) | 2.32 (including) |
| Blenloader | Blender | 2.33 (including) | 2.33 (including) |
| Blenloader | Blender | 2.33a (including) | 2.33a (including) |
| Blenloader | Blender | 2.34 (including) | 2.34 (including) |
| Blenloader | Blender | 2.35 (including) | 2.35 (including) |
| Blenloader | Blender | 2.37 (including) | 2.37 (including) |
| Blenloader | Blender | 2.37a (including) | 2.37a (including) |
| Blenloader | Blender | 2.39 (including) | 2.39 (including) |
| Blenloader | Blender | 2.40_alpha (including) | 2.40_alpha (including) |