<issue tracker="bnc" id="1207377">VUL-0: CVE-2022-45748: assimp: UaF in ColladaParser:ExtractDataObjectFromChannel in file /code/AssetLib/Collada/ColladaParser.cpp.</issue>
<issue tracker="bnc" id="1218474">build failure for assimp</issue>
<issue tracker="bnc" id="1228142">VUL-0: CVE-2024-40724: TRACKERBUG: assimp: heap-based buffer overflow in the PLY importer class</issue>
<issue tracker="bnc" id="1230679">VUL-0: CVE-2024-45679: assimp: Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.3 allows a local attacker to execute arbitrary code by importing a specially crafted file into the product.</issue>
<issue tracker="cve" id="2022-45748"/>
<issue tracker="cve" id="2024-40724"/>
<issue tracker="cve" id="2024-45679"/>
<packager>alarrosa</packager>
<rating>important</rating>
<category>security</category>
<summary>Security update for assimp</summary>
<description>This update for assimp fixes the following issues:
- CVE-2022-45748: Fixed UaF in ColladaParser:ExtractDataObjectFromChannel in file /code/AssetLib/Collada/ColladaParser.cpp. (bsc#1207377)
Update to 5.4.3
* Ply-Importer: Fix vulnerability
* `build`: Add ccache support
* Update glTF2AssetWriter.inl
* Update PyAssimp structs with Skeleton & SkeletonBone members
* FBX: add metadata as properties
* Fix casting typo in D3MFExporter::writeBaseMaterials (color
channels < 1.0f were zeroed out)
* Fix to judge 'multi-configuration' correctly
* Fix potential memory leak in SceneCombiner for LWS/IRR/MD3
loader
* Fix copying private data when source pointer is NULL
* Bump softprops/action-gh-release from 1 to 2
* Bump actions/upload-artifact from 1 to 4
* Bump actions/download-artifact from 1 to 4
* fix GetShortFilename function
* Added more Maya materials
* Sparky kitty studios master
* Expose aiGetEmbeddedTexture to C-API
* Fix leak in loader
* Fix MSVC build error
* Revert variable name (fix broken build on android)
* Fixes possible out-of-bound read in findDegenerate
* Remove recursive include
* include Exceptional.h in 3DSExporter.cpp
* Use DRACO_GLTF_BITSTREAM
* Fix MSVC PDBs and permit them to be disabled if required
* Added AND condition in poly2tri dll_symbol.h
* fixing static build
* FBX exporter - handle multiple vertex color channels
* Update DefaultIOSystem.cpp
* Make coord transfor for hs1 files optional
* Return false instead of crash
* A fuzzed stride could cause the max count to become negative
and hence wrap around uint
* CalcTangents: zero vector is invalid for tangent/bitangent
* Mosfet80 updatedpoli2tri
* Fix a fuzz test heap buffer overflow in mdl material loader
* Introduce interpolation mode to vectro and quaternion keys
* Update Python structs with missing fields
* Introduce interpolation mode to vectro and quaternion keys
* Kimkulling/fix double precision tests
* [USD] Integrate "tinyusdz" project
* Update Readme.md
* Allow empty slots in mTextureCoords
* Fix compile warning
* Replace raw pointers by std::string
* Fix potential heapbuffer overflow in md5 parsing
* Fixes bsc#1230679, CVE-2024-45679.
- fix check failure on s390x (bsc#1218474)
- Update to 5.4.2
* Fix building on Haiku
* Reduce memory consumption in JoinVerticesProcess::ProcessMesh()
significantly
* Fix: Add check for invalid input argument
* Replace an assert
* Extension of skinning data export to GLB/GLTF format
* Fix output floating-point values to fbx
* Update ImproveCacheLocality.cpp
* Update Readme.md
* Deep arsdk bone double free
* Fix Spelling error
* use size in order to be compatible with float and double
* Fix: Add missing transformation for normalized normals.
* Fix: Implicit Conversion Error
* Fix add checks for indices
* Update FBXBinaryTokenizer.cpp
* link to external minizip with full path
* utf8 header not found
* Rm unnecessary deg->radian conversion in FBX exporter
* Fix empty mesh handling
* Refactoring: Some cleanups
* Fix invalid read of uint from uvwsrc
* Remove double delete
* fix mesh-name error.
* COLLADA fixes for textures in C4D input
* Use the correct allocator for deleting objects in case of
duplicate animation Ids
* Fix container overflow in MMD parser
* Fix: PLY heap buffer overflow
* Fix: Check if index for mesh access is out of range
* Update FBXConverter.cpp
* FBX: Use correct time scaling
* Drop explicit inclusion of contrib/ headers
* Update Build.md
* Fix buffer overflow in FBX::Util::DecodeBase64()
* Readme.md: correct 2 errors in section headers
* Fix double free in Video::~Video()
* FBXMeshGeometry: solve issue #5116 using patch provided
* Fix target names not being imported on some gLTF2 models
* correct grammar/typographic errors in comments (8 files)
