tinygltf: CVE-2022-3008

Debian Bug report logs - #1019357
tinygltf: CVE-2022-3008

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: tinygltf: CVE-2022-3008

Date: Wed, 07 Sep 2022 21:49:26 +0200

Source: tinygltf
Version: 2.5.0+dfsg-4
Severity: important
Tags: security upstream
Forwarded: https://github.com/syoyo/tinygltf/issues/368
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 2.5.0+dfsg-3

Hi,

The following vulnerability was published for tinygltf.

CVE-2022-3008[0]:
| The tinygltf library uses the C library function wordexp() to perform
| file path expansion on untrusted paths that are provided from the
| input file. This function allows for command injection by using
| backticks. An attacker could craft an untrusted path input that would
| result in a path expansion. We recommend upgrading to 2.6.0 or past
| commit 52ff00a38447f06a17eab1caa2cf0730a119c751


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-3008
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3008
[1] https://github.com/syoyo/tinygltf/issues/368
[2] https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49053
[3] https://github.com/syoyo/tinygltf/commit/52ff00a38447f06a17eab1caa2cf0730a119c751

Regards,
Salvatore

Send a report that this bug log contains spam.