| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| openbabel | < 3.2.0 | 3.2.0 |
| open babel | = 3.1.1 |
A memory-safety vulnerability in Open Babel's GRO parser caused an uninitialized pointer dereference when reading a crafted input file.
The flaw was in the residue handling of the GRO reader. A malformed record caused the parser to use a residue pointer that had never been initialized.
Open Babel is a C++ library and CLI used to read and write chemistry
file formats; it is shipped by Linux distributions and embedded in
services that may parse untrusted input. Triggering this vulnerability
requires the victim to open a malicious GRO file with the obabel
tool, the OBConversion API, or any of the language bindings (Python,
Ruby, Java, R, Perl, C#, PHP).
All releases up to and including 3.1.1.
3.2.0 (released 2026-05-26).
Fix commit: https://github.com/openbabel/openbabel/commit/fa9a2d9a
A minimized reproducer for this CVE is checked in under
test/files/fuzz_regress/ and is exercised on every CI build under
ASAN+UBSAN by the fuzzregresstest harness.
Reported by Cisco TALOS.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí