assimp-devel-6.0.2-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2025:16271 Final 1 1 2025-07-03T00:00:00Z current 2025-07-03T00:00:00Z 2025-07-03T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z assimp-devel-6.0.2-1.1 on GA media These are all security issues fixed in the assimp-devel-6.0.2-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2025-16271 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2025-2750/ SUSE CVE CVE-2025-2750 page https://www.suse.com/security/cve/CVE-2025-2751/ SUSE CVE CVE-2025-2751 page https://www.suse.com/security/cve/CVE-2025-2757/ SUSE CVE CVE-2025-2757 page https://www.suse.com/security/cve/CVE-2025-3158/ SUSE CVE CVE-2025-3158 page https://www.suse.com/security/cve/CVE-2025-3548/ SUSE CVE CVE-2025-3548 page openSUSE Tumbleweed assimp-devel-6.0.2-1.1 libassimp6-6.0.2-1.1 assimp-devel-6.0.2-1.1 as a component of openSUSE Tumbleweed libassimp6-6.0.2-1.1 as a component of openSUSE Tumbleweed A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation leads to out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. CVE-2025-2750 openSUSE Tumbleweed:assimp-devel-6.0.2-1.1 openSUSE Tumbleweed:libassimp6-6.0.2-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-2750.html CVE-2025-2750 https://bugzilla.suse.com/1240014 SUSE Bug 1240014 A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. CVE-2025-2751 openSUSE Tumbleweed:assimp-devel-6.0.2-1.1 openSUSE Tumbleweed:libassimp6-6.0.2-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-2751.html CVE-2025-2751 https://bugzilla.suse.com/1240016 SUSE Bug 1240016 A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The manipulation of the argument data leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. CVE-2025-2757 openSUSE Tumbleweed:assimp-devel-6.0.2-1.1 openSUSE Tumbleweed:libassimp6-6.0.2-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-2757.html CVE-2025-2757 https://bugzilla.suse.com/1240027 SUSE Bug 1240027 A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. CVE-2025-3158 openSUSE Tumbleweed:assimp-devel-6.0.2-1.1 openSUSE Tumbleweed:libassimp6-6.0.2-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-3158.html CVE-2025-3158 https://bugzilla.suse.com/1240773 SUSE Bug 1240773 A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp up to 5.4.3. This issue affects the function aiString::Set in the library include/assimp/types.h of the component File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. CVE-2025-3548 openSUSE Tumbleweed:assimp-devel-6.0.2-1.1 openSUSE Tumbleweed:libassimp6-6.0.2-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-3548.html CVE-2025-3548 https://bugzilla.suse.com/1241364 SUSE Bug 1241364