"OpenSG is a portable scenegraph system to create realtime graphics programs, e.g. for virtual reality applications". Secunia Research has discovered a vulnerability in OpenSG, which can be exploited by malicious people to compromise an application using the library.
The vulnerability is caused due to a boundary error within the "HDRImageFileType::checkHDR()" function in Source/System/Image/ OSGHDRImageFileType.cpp, which can be exploited to cause a stack-based buffer overflow by e.g. tricking a user into opening a specially crafted Radiance RGBE (*.hdr) file.
Successful exploitation allows execution of arbitrary code.
Solution:
Fixed in the CVS repository
Time Table:
09/01/2009 - Vendor notified.
13/01/2009 - Vendor response.
16/01/2009 - Vendor notified about incomplete fix.
18/01/2009 - Vendor response.
20/01/2009 - Public disclosure.
