Vulnerability DatabaseCVE-2022-38072
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2022-38072
April 03, 2023
An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and v0.98.4. A specially-crafted stl file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Affected Packages
admesh (PYTHON):
Affected version(s) >=0.96 <0.98.5
Fix Suggestion:
Update to version 0.98.5
Related Resources (7)
https://github.com/pypa/advisory-database/tree/main/vulns/admesh/PYSEC-2023-263.yaml
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1594
https://github.com/admesh/admesh/commit/5fab257268a0ee6f832c18d72af89810a29fbd5f
https://people.canonical.com/~ubuntu-security/cve/CVE-2022-38072
https://github.com/admesh/python-admesh
https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1594
https://nvd.nist.gov/vuln/detail/CVE-2022-38072
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.9
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
LOW
Weakness Type (CWE)
Incorrect Access of Indexable Resource ('Range Error')
CWE-118
Improper Validation of Array Index
CWE-129
EPSS
Base Score:
0.10