vtk@9.0.2

Affected versions of this package are vulnerable to Expired Pointer Dereference in the vtkPNGReader::ExecuteInformation method in IO/Image/vtkPNGReader.cxx. An attacker can crash a VTK application with a malformed PNG, because a libpng failure after the reader calls HandleLibPngError executes a longjmp back to a setjmp that helper established before returning, so the later fclose(fp) and png_destroy_read_struct cleanup dereference a stale fp whose stack frame has already been overwritten. Exploitation requires the application to load an untrusted PNG through the reader, and on glibc 2.24+ the _IO_vtable_check hardening can convert some attempts into a SIGABRT, a mitigation absent on glibc 2.24 and earlier and on other C libraries.

There is no fixed version for vtk.

Affected versions of this package are vulnerable to Expired Pointer Dereference in the vtkPNGReader::vtkInternals::HandleLibPngError method in IO/Image/vtkPNGReader.cxx. An attacker can crash a VTK application with a malformed PNG that passes png_read_info header parsing but fails during png_read_image or png_read_end, because libpng then executes a longjmp back to a setjmp that HandleLibPngError established before returning, and the following fclose(fp) runs against a stale fp from the unwound frame. Exploitation requires the application to decode an untrusted PNG through the VTK PNG reader, and on glibc 2.24+ the _IO_vtable_check hardening can turn some cases into a SIGABRT, a mitigation that may be absent on other C libraries.

There is no fixed version for vtk.

Affected versions of this package are vulnerable to Out-of-bounds Read in the vtkChacoReader::InputGraph2 method in IO/Geometry/vtkChacoReader.cxx, which reads the 1-based neighbor vertex IDs from a Chaco graph's adjacency lists without validating each against NumberOfVertices. An attacker can read heap memory beyond the points array, and crash the process, by supplying a Chaco file whose adjacency entry references an out-of-range vertex, which becomes a point ID that GetCell() resolves through GetPoints() into a GetTuple(idsPtr[i], point) read past the array end. Reaching the read requires the application to parse the attacker-supplied Chaco file with vtkChacoReader and then access the resulting cell or point data.

There is no fixed version for vtk.

Affected versions of this package are vulnerable to Out-of-bounds Write in the vtkDEMReader::ReadProfiles method in IO/Image/vtkDEMReader.cxx, which derives rowId and lastRow from the file-supplied profileId[0] and profileSize[0] of a USGS DEM B-record and never checks them against the grid's numberOfRows and numberOfColumns. An attacker can write past the end of the allocated vtkImageData buffer, and crash the process, by supplying a DEM file whose profile prefix drives the *(outPtr + columnId + row * numberOfColumns) store loop beyond the image bounds. Exploitation requires the application to parse the attacker-supplied .dem file with vtkDEMReader.

There is no fixed version for vtk.