MGASA-2021-0368

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2021-0368.html
Import Source
https://advisories.mageia.org/MGASA-2021-0368.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2021-0368
Related
Published
2021-07-25T08:34:17Z
Modified
2021-07-25T08:16:10Z
Summary
Updated lib3mf packages fix security vulnerability
Details

A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability (CVE-2021-21772).

A new package 'act' is introduced to build newer version of lib3mf.

Also, openscad is rebuilt against this updated library.

References
Credits

Affected packages

Mageia:8 / lib3mf

Package

Name
lib3mf
Purl
pkg:rpm/mageia/lib3mf?distro=mageia-8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.1.1-1.mga8

Ecosystem specific 

{
    "section": "core"
}

Mageia:8 / act

Package

Name
act
Purl
pkg:rpm/mageia/act?distro=mageia-8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.6.0-4.mga8

Ecosystem specific 

{
    "section": "core"
}

Mageia:8 / openscad

Package

Name
openscad
Purl
pkg:rpm/mageia/openscad?distro=mageia-8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2021.01-1.2.mga8

Ecosystem specific 

{
    "section": "core"
}