Advisory ROSA-SA-2025-2950

software: assimp 5.0.1 OS: ROSA-CHROME unaffected versions = assimp-5.0.1.1-6 affected versions assimp-5.0.1.1-6 CVE-ID: CVE-2024-45679 BDU-ID: 2025-02665 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the 3D model import library Open Asset Import Library Assimp is related to a buffer overflow in...

Oracle Linux 9 : qt5-qt3d (ELSA-2025-12842)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-12842 advisory. 5.15.9-2 - Assimp: Fix heap-based overflow in Assimp::LWO::AnimResolver::UpdateAnimRangeSetup Resolves: RHEL-105000 - Assimp: Fix heap-based overflow ...

assimp: Open Asset Import Library Assimp LWO File LWOAnimation.cpp UpdateAnimRangeSetup heap-based overflow

A flaw has been found in the Open Asset Import Library assimp. In affected versions, a malformed LWO file may trigger a heap-based buffer overflow, which may lead to an application crash or other undefined behavior...

RHEL 9 : qt5-qt3d (RHSA-2025:12842)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:12842 advisory. Qt 3D provides functionality for near-realtime simulation systems with support for 2D and 3D rendering in both Qt C++ and Qt Quick...

qt5-qt3d security update

5.15.9-2 - Assimp: Fix heap-based overflow in Assimp::LWO::AnimResolver::UpdateAnimRangeSetup Resolves: RHEL-105000 - Assimp: Fix heap-based overflow in Assimp::ASE::Parser::ParseLV4MeshBonesVertices Resolves: RHEL-105005...

OSV-2025-580 UNKNOWN READ in signed char Assimp::StreamReader<false, false>::Get<signed char>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=434414094 Crash type: UNKNOWN READ Crash state: signed char Assimp::StreamReader::Get Assimp::COBImporter::ReadBinaryFile Assimp::COBImporter::InternReadFile...

PT-2025-46083

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=434414094 Crash type: UNKNOWN READ Crash state: signed char Assimp::StreamReader::Get Assimp::COBImporter::ReadBinaryFile Assimp::COBImporter::InternReadFile...

assimp:assimp_fuzzer: Crash in signed char Assimp::StreamReader<false, false>::Get<signed char>

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=6028454886965248 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzerubsanassimp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x5c6f1071a754 Crash Stat...

assimp:assimp_fuzzer: Heap-buffer-overflow in Assimp::COBImporter::BuildNodes

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=4837921222098944 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzerasanassimp Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address:...

assimp:assimp_fuzzer: Heap-use-after-free in char const* Assimp::fast_atoreal_move<float, DeadlyImportError>

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=5938122863214592 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzerasanassimp Platform Id: linux Crash Type: Heap-use-after-free WRITE 4 Crash Address:...

assimp-devel-6.0.2-1.1 on GA media (moderate)

assimp-devel-6.0.2-1.1 on GA media Announcement ID: openSUSE-SU-2025:15209-1 Rating: moderate Cross-References: CVE-2025-2750 CVE-2025-2751 CVE-2025-2757 CVE-2025-3158 CVE-2025-3548 CVSS scores: CVE-2025-3158 SUSE : 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE-2025-3158 SUSE : 4.8...

OPENSUSE-SU-2025:15209-1 assimp-devel-6.0.2-1.1 on GA media

These are all security issues fixed in the assimp-devel-6.0.2-1.1 package on the GA media of openSUSE Tumbleweed...

assimp:assimp_fuzzer: Heap-buffer-overflow in Assimp::MDL::HalfLife::HL1MDLLoader::validate_header

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=5875547924398080 Project: assimp Fuzzing Engine: honggfuzz Fuzz Target: assimpfuzzer Job Type: honggfuzzasanassimp Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

Amazon Linux 2 : qt5-qt3d (ALAS-2025-2903)

The version of qt5-qt3d installed on the remote host is prior to 5.15.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2903 advisory. A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the...

Medium: qt5-qt3d

Issue Overview: A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation leads to...

Assimp FileHandler DoS

The vulnerability of the FileHandler component in the cross-platform import library for 3D models, Assimp Open Asset Import Library, is related to buffer overflow in the stack. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Assimp Malformed File Handler DoS

The vulnerability of the Malformed File Handler component in the cross-platform 3D model import library Assimp Open Asset Import Library is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to cause a service failure...

Assimp ASE File Handler DoS

The vulnerability of the ASE File Handler component of the cross-platform 3D model import library Assimp Open Asset Import Library is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

Assimp FileHandler DoS

The vulnerability of the FileHandler component of the cross-platform 3D model import library Assimp Open Asset Import Library is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

SUSE CVE-2025-6119

A vulnerability classified as critical has been found in Open Asset Import Library Assimp up to 5.4.3. Affected is the function Assimp::BVHLoader::ReadNodeChannels in the library assimp/code/AssetLib/BVH/BVHLoader.cpp. The manipulation of the argument pNode leads to use after free. Attacking...