Bug 30413 - blender new security issues CVE-2022-054[4-6]
Summary: blender new security issues CVE-2022-054[4-6]
Status: RESOLVED OLD
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: All Packagers
QA Contact: Sec team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-05-11 20:18 CEST by David Walser
Modified: 2024-01-12 09:51 CET (History)
2 users (show)

See Also:
Source RPM: blender-2.83.10-3.1.mga8.src.rpm
CVE:
Status comment: Patches available from Debian and Fedora

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2022-05-11 20:18:11 CEST 
Fedora has issued an advisory today (May 11):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/GIZADV3AHTWZ2YKEFTVLNK3K4F4KTYLM/

I'm not sure if Mageia 8 is affected.
David Walser 2022-05-11 20:19:03 CEST

Status comment: (none) => Patch available from Fedora
See Also: (none) => https://bugs.mageia.org/show_bug.cgi?id=30366

Comment 1 Lewis Smith 2022-05-11 21:43:45 CEST 
Blender is nominally with daviddavid, but has been dealt with by other people for nearly a year, so assigning this globally.

CC: (none) => geiger.david68210
Assignee: bugsquad => pkg-bugs

Comment 2 David Walser 2022-06-30 00:29:41 CEST 
Debian-LTS has issued an advisory on June 28:
https://www.debian.org/lts/security/2022/dla-3060

It fixes two new CVEs (fixed upstream in 2.83.19) and the one Fedora fixed (fixed upstream, but possibly not in the 2.83.x branch).

Summary: blender new security issue CVE-2022-0546 => blender new security issues CVE-2022-054[4-6]
Whiteboard: (none) => MGA8TOO
Status comment: Patch available from Fedora => Patches available from Debian and Fedora

Comment 3 David Walser 2022-07-05 14:50:49 CEST 
Debian has issued an advisory for this on July 4:
https://www.debian.org/security/2022/dsa-5176
Comment 4 David GEIGER 2023-06-27 03:01:30 CEST 
On cauldron we have the 3.3.6 release so it should be fixed!
David Walser 2023-06-27 14:10:45 CEST

Version: Cauldron => 8
Whiteboard: MGA8TOO => (none)
Source RPM: blender-2.93.7-2.mga9.src.rpm => blender-2.83.10-3.1.mga8.src.rpm

Comment 5 Nicolas Salguero 2024-01-12 09:51:21 CET 
Mageia 8 EOL

CC: (none) => nicolas.salguero
Status: NEW => RESOLVED
Resolution: (none) => OLD
Note You need to log in before you can comment on or make changes to this bug.