GHSA-grjp-54v3-c442
GHSA-grjp-54v3-c442 · OpenUSD File Parsing Use-After-Free Remote Code Execution Vulnerability
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
# Patch This is fixed with [commit b953092](https://github.com/PixarAnimationStudios/OpenUSD/commit/b9530922b6a8ea72cd43661226b693fff8abbe4c), with the fix available in OpenUSD 25.11 and onwards. # Summary We have been advised by Zero Day Initiative that our usage of the USD framework may constitute a Use-After-Free Remote Code Execution Vulnerability. They have sent us the attached file illustrating the issue. Indeed, we see a use after free exception when running the file through our importer with an address sanitizer. [zdi-23709-poc0.zip](https://github.com/user-attachments/files/17474297/zdi-23709-poc0.zip) Thanks in advance.
CVSS 6.9 · Mittel · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: python
Betroffene Produkte und Versionen
usd-core PyPI
- Softwareversionen
- 20.11
- 21.11
- 21.2
- 21.5
- 21.8
- 22.11
- 22.3
- 22.5
- 22.5.post1
- 22.8
- 23.11
- 23.2
- 23.5
- 23.8
- 24.11
- 24.3
- 24.5
- 24.8
- 25.2
- 25.2.post1
- 25.5
- 25.5.1
- 25.8
- Betroffene Versionsbereiche
- ECOSYSTEM: < 25.11
Auf 25.11 aktualisieren