| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| openbabel | < 3.2.0 | 3.2.0 |
| open babel | = 3.1.1 |
A memory-safety vulnerability in Open Babel's PQS parser caused an uninitialized pointer dereference when reading a crafted input file.
The flaw was in the pFormat handling of the PQS reader. A malformed
input caused the parser to dereference a format pointer that had
never been initialized.
Open Babel is a C++ library and CLI used to read and write chemistry
file formats; it is shipped by Linux distributions and embedded in
services that may parse untrusted input. Triggering this vulnerability
requires the victim to open a malicious PQS file with the obabel
tool, the OBConversion API, or any of the language bindings (Python,
Ruby, Java, R, Perl, C#, PHP).
All releases up to and including 3.1.1.
3.2.0 (released 2026-05-26).
Fix commit: https://github.com/openbabel/openbabel/commit/2a7d2cda
A minimized reproducer for this CVE is checked in under
test/files/fuzz_regress/ and is exercised on every CI build under
ASAN+UBSAN by the fuzzregresstest harness.
Reported by Cisco TALOS.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí