{"id":"CVE-2025-10997","aliases":["DEBIAN-CVE-2025-10997","EUVD-2025-31197","GHSA-8wq6-qh76-wpv9","GHSA-95gx-jmhp-5p29","PYSEC-2026-2778","UBUNTU-CVE-2025-10997","openSUSE-SU-2026:21190-1"],"status":"published","title":"Open Babel chemkinformat.cpp CheckSpecies heap-based overflow","description":"A flaw has been found in Open Babel up to 3.1.1. Impacted is the function ChemKinFormat::CheckSpecies of the file /src/formats/chemkinformat.cpp. Executing manipulation can lead to heap-based buffer overflow. The attack can only be executed locally. The exploit has been published and may be used.","severity":{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00286,"percentile":0.21331,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-122"],"published":"2025-09-26T02:32:09.748Z","modified":"2026-10-28T02:31:03Z","fixes":[{"ecosystem":"PyPI","package":"openbabel","fixed_in":["3.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1+dfsg-10","3.1.1+dfsg-11","3.1.1+dfsg-12","3.1.1+dfsg-13","3.1.1+dfsg-14","3.1.1+dfsg-15~exp","3.1.1+dfsg-9","3.2.0+dfsg-1","3.2.0+dfsg-1~exp"]},{"source":"osv","ecosystem":"Debian:13","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1+dfsg-12","3.1.1+dfsg-13","3.1.1+dfsg-14","3.1.1+dfsg-15~exp","3.2.0+dfsg-1","3.2.0+dfsg-1~exp"]},{"source":"osv","ecosystem":"Debian:14","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1+dfsg-12","3.1.1+dfsg-13","3.1.1+dfsg-14","3.1.1+dfsg-15~exp","3.2.0+dfsg-1","3.2.0+dfsg-1~exp"]},{"source":"osv","ecosystem":"PyPI","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}],"versions":["1.8","1.8.1","1.8.2","1.8.3","1.8.4","2.4.0","2.4.1","3.0.0","3.0.0a1","3.1.1","3.1.1.1"]},{"source":"osv","ecosystem":"PyPI","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0"}]}],"versions":["1.8","1.8.1","1.8.2","1.8.3","1.8.4","2.4.0","2.4.1","3.0.0","3.0.0a1","3.1.1","3.1.1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2+dfsg-2.2","2.3.2+dfsg-2.2build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1+dfsg-3","2.4.1+dfsg-3build1","2.4.1+dfsg-5.1","2.4.1+dfsg-6","3.0.0+dfsg-3","3.0.0+dfsg-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1+dfsg-6ubuntu1","3.1.1+dfsg-6ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1+dfsg-9build2","3.1.1+dfsg-9ubuntu1","3.1.1+dfsg-9ubuntu2","3.1.1+dfsg-9ubuntu4","3.1.1+dfsg-9ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1+dfsg-11ubuntu3","3.1.1+dfsg-11ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1+dfsg-11ubuntu5","3.1.1+dfsg-14ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1+dfsg-11ubuntu4","3.1.1+dfsg-11ubuntu5"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openbabel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-bp160.1.1"}]}],"bundled":23}],"products":[{"vendor":"openbabel","product":"open_babel"}],"references":[{"url":"https://vuldb.com/?id.325925","tags":["vdb-entry","technical-description","Third Party Advisory","VDB Entry","advisory","web","report"]},{"url":"https://vuldb.com/?ctiid.325925","tags":["signature","permissions-required","Permissions Required","VDB Entry","report","web"]},{"url":"https://vuldb.com/?submit.654062","tags":["third-party-advisory","Third Party Advisory","VDB Entry","advisory","web","report"]},{"url":"https://github.com/openbabel/openbabel/issues/2830","tags":["issue-tracking","Exploit","Issue Tracking","report","web"]},{"url":"https://github.com/user-attachments/files/22318543/poc.zip","tags":["exploit","Exploit","evidence","web","report"]},{"url":"https://github.com/openbabel/openbabel/security/advisories/GHSA-8wq6-qh76-wpv9","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10997","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8wq6-qh76-wpv9","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-95gx-jmhp-5p29"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10997.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-10997","tags":["advisory"]},{"url":"https://github.com/openbabel/openbabel","tags":["package"]},{"url":"https://pypi.org/project/openbabel","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-10997","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-10997","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1217676","tags":["report"]},{"url":"https://bugzilla.suse.com/1258501","tags":["report"]},{"url":"https://bugzilla.suse.com/1258507","tags":["report"]},{"url":"https://bugzilla.suse.com/1259041","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3408","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-10997","title":"Open Babel chemkinformat.cpp CheckSpecies heap-based overflow","description":"A flaw has been found in Open Babel up to 3.1.1. Impacted is the function ChemKinFormat::CheckSpecies of the file /src/formats/chemkinformat.cpp. Executing manipulation can lead to heap-based buffer overflow. The attack can only be executed locally. The exploit has been published and may be used.","status":"published","published":"2025-09-26T02:32:09.748Z","modified":"2025-09-26T19:28:43.143Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","level":"medium","assessor":"cna"},{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","level":"medium","assessor":"cna"},{"version":"2.0","score":4.3,"vector":"AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR","assessor":"cna"}],"cwes":["CWE-122","CWE-119"],"updated_at":"2026-11-02T14:32:30.643267Z"}],"euvd":[{"id":"EUVD-2025-31197","description":"Open Babel has heap buffer overflow in ChemKin ChemKinFormat::CheckSpecies","status":"published","published":"2026-07-01T17:39:08Z","modified":"2026-07-01T17:39:08Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T18:20:19.066641Z"}],"ghsa":[{"id":"GHSA-8wq6-qh76-wpv9","title":"Open Babel has heap buffer overflow in ChemKin ChemKinFormat::CheckSpecies","description":"### Summary\n\nA memory-safety vulnerability in Open Babel's ChemKin parser caused\na heap buffer overflow when reading a crafted input file.\n\n### Details\n\nThe flaw was in `ChemKinFormat::CheckSpecies`. A malformed species\nrecord caused the parser to write past the end of a heap-allocated\nbuffer.\n\n### Impact\n\nOpen Babel is a C++ library and CLI used to read and write chemistry\nfile formats; it is shipped by Linux distributions and embedded in\nservices that may parse untrusted input. Triggering this vulnerability\nrequires the victim to open a malicious ChemKin file with the\n`obabel` tool, the `OBConversion` API, or any of the language\nbindings (Python, Ruby, Java, R, Perl, C#, PHP).\n\n### Affected versions\n\nAll releases up to and including 3.1.1.\n\n### Patched version\n\n3.2.0 (released 2026-05-26).\n\n### Patch\n\nFix commit: https://github.com/openbabel/openbabel/commit/af4a4212\nOriginally reported as #2830; fixes consolidated in #2913.\n\nA minimized reproducer for this CVE is checked in under\n`test/files/fuzz_regress/` and is exercised on every CI build under\nASAN+UBSAN by the `fuzzregresstest` harness.\n\n### Credit\n\nReported via OSS-Fuzz.","status":"published","published":"2026-07-01T17:39:08Z","modified":"2026-07-01T17:39:09Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-122"],"updated_at":"2026-11-02T14:40:36.577366Z"},{"id":"GHSA-95gx-jmhp-5p29","title":"Duplicate Advisory: Open Babel has heap buffer overflow in ChemKin ChemKinFormat::CheckSpecies","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-8wq6-qh76-wpv9. This link is maintained to preserve external references.\n\n## Original Description\nA flaw has been found in Open Babel up to 3.1.1. Impacted is the function ChemKinFormat::CheckSpecies of the file /src/formats/chemkinformat.cpp. Executing manipulation can lead to heap-based buffer overflow. The attack can only be executed locally. The exploit has been published and may be used.","status":"withdrawn","published":"2025-09-26T03:31:07Z","modified":"2026-07-01T17:38:37Z","cvss":[{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:40:36.577366Z"}],"nvd":[{"id":"CVE-2025-10997","description":"A flaw has been found in Open Babel up to 3.1.1. Impacted is the function ChemKinFormat::CheckSpecies of the file /src/formats/chemkinformat.cpp. Executing manipulation can lead to heap-based buffer overflow. The attack can only be executed locally. The exploit has been published and may be used.","status":"published","published":"2025-09-26T03:15:43.517Z","modified":"2026-10-19T16:10:00.26Z","cvss":[{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:L/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"secondary"}],"cwes":["CWE-119","CWE-122"],"updated_at":"2026-11-02T14:11:33.36253Z"}],"osv":[{"id":"CVE-2025-10997","title":"Open Babel chemkinformat.cpp CheckSpecies heap-based overflow","description":"A flaw has been found in Open Babel up to 3.1.1. Impacted is the function ChemKinFormat::CheckSpecies of the file /src/formats/chemkinformat.cpp. Executing manipulation can lead to heap-based buffer overflow. The attack can only be executed locally. The exploit has been published and may be used.","status":"published","published":"2025-09-26T02:32:09.748Z","modified":"2026-10-28T02:31:03.195049301Z","cvss":[{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-119","CWE-122"],"updated_at":"2026-11-02T15:44:46.024537Z"},{"id":"DEBIAN-CVE-2025-10997","description":"A flaw has been found in Open Babel up to 3.1.1. Impacted is the function ChemKinFormat::CheckSpecies of the file /src/formats/chemkinformat.cpp. Executing manipulation can lead to heap-based buffer overflow. The attack can only be executed locally. The exploit has been published and may be used.","status":"published","published":"2025-09-26T03:15:43.517Z","modified":"2026-10-23T18:04:32.736570297Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"GHSA-8wq6-qh76-wpv9","title":"Open Babel has heap buffer overflow in ChemKin ChemKinFormat::CheckSpecies","description":"### Summary\n\nA memory-safety vulnerability in Open Babel's ChemKin parser caused\na heap buffer overflow when reading a crafted input file.\n\n### Details\n\nThe flaw was in `ChemKinFormat::CheckSpecies`. A malformed species\nrecord caused the parser to write past the end of a heap-allocated\nbuffer.\n\n### Impact\n\nOpen Babel is a C++ library and CLI used to read and write chemistry\nfile formats; it is shipped by Linux distributions and embedded in\nservices that may parse untrusted input. Triggering this vulnerability\nrequires the victim to open a malicious ChemKin file with the\n`obabel` tool, the `OBConversion` API, or any of the language\nbindings (Python, Ruby, Java, R, Perl, C#, PHP).\n\n### Affected versions\n\nAll releases up to and including 3.1.1.\n\n### Patched version\n\n3.2.0 (released 2026-05-26).\n\n### Patch\n\nFix commit: https://github.com/openbabel/openbabel/commit/af4a4212\nOriginally reported as #2830; fixes consolidated in #2913.\n\nA minimized reproducer for this CVE is checked in under\n`test/files/fuzz_regress/` and is exercised on every CI build under\nASAN+UBSAN by the `fuzzregresstest` harness.\n\n### Credit\n\nReported via OSS-Fuzz.","status":"published","published":"2026-07-01T17:39:08Z","modified":"2026-07-13T16:43:38.658574281Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-122"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"GHSA-95gx-jmhp-5p29","title":"Duplicate Advisory: Open Babel has heap buffer overflow in ChemKin ChemKinFormat::CheckSpecies","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-8wq6-qh76-wpv9. This link is maintained to preserve external references.\n\n## Original Description\nA flaw has been found in Open Babel up to 3.1.1. Impacted is the function ChemKinFormat::CheckSpecies of the file /src/formats/chemkinformat.cpp. Executing manipulation can lead to heap-based buffer overflow. The attack can only be executed locally. The exploit has been published and may be used.","status":"withdrawn","published":"2025-09-26T03:31:07Z","modified":"2026-07-01T17:45:34.281980307Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"PYSEC-2026-2778","title":"Open Babel has heap buffer overflow in ChemKin ChemKinFormat::CheckSpecies","description":"### Summary\n\nA memory-safety vulnerability in Open Babel's ChemKin parser caused\na heap buffer overflow when reading a crafted input file.\n\n### Details\n\nThe flaw was in `ChemKinFormat::CheckSpecies`. A malformed species\nrecord caused the parser to write past the end of a heap-allocated\nbuffer.\n\n### Impact\n\nOpen Babel is a C++ library and CLI used to read and write chemistry\nfile formats; it is shipped by Linux distributions and embedded in\nservices that may parse untrusted input. Triggering this vulnerability\nrequires the victim to open a malicious ChemKin file with the\n`obabel` tool, the `OBConversion` API, or any of the language\nbindings (Python, Ruby, Java, R, Perl, C#, PHP).\n\n### Affected versions\n\nAll releases up to and including 3.1.1.\n\n### Patched version\n\n3.2.0 (released 2026-05-26).\n\n### Patch\n\nFix commit: https://github.com/openbabel/openbabel/commit/af4a4212\nOriginally reported as #2830; fixes consolidated in #2913.\n\nA minimized reproducer for this CVE is checked in under\n`test/files/fuzz_regress/` and is exercised on every CI build under\nASAN+UBSAN by the `fuzzregresstest` harness.\n\n### Credit\n\nReported via OSS-Fuzz.","status":"published","published":"2026-07-13T15:46:25.618578Z","modified":"2026-07-13T16:31:41.543129322Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"},{"id":"UBUNTU-CVE-2025-10997","description":"A flaw has been found in Open Babel up to 3.1.1. Impacted is the function ChemKinFormat::CheckSpecies of the file /src/formats/chemkinformat.cpp. Executing manipulation can lead to heap-based buffer overflow. The attack can only be executed locally. The exploit has been published and may be used.","status":"published","published":"2025-09-26T03:15:00Z","modified":"2026-10-17T12:56:47.672832357Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":1.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"openSUSE-SU-2026:21190-1","title":"Security update for openbabel","description":"This update for openbabel fixes the following issues:\n\nChanges in openbabel:\n\n- Update to version 3.2.0:\n  * Add an L-BFGS optimizer, used by default for gen3d and\n    conformer searches\n  * New macrocycle ring builder (Dale codes) for better initial\n    3D geometry of large rings\n  * Add KET (Ketcher JSON) and ChemicalJSON (.cjson) format\n    support\n  * Drop Python 2 support; Python 3.13 supported\n  * Faster, vectorized distance-geometry implementation\n  * Full CMake 4 compatibility and modernized build\n  * Backwards compatible with 3.0 and 3.1\n  * Fix many crash and memory-safety bugs found via OSS-Fuzz\n    and TALOS, including the following security issues:\n    CVE-2022-37331 (boo#1217676), CVE-2022-41793, CVE-2022-42885,\n    CVE-2022-43467, CVE-2022-43607, CVE-2022-44451,\n    CVE-2022-46280, CVE-2022-46289, CVE-2022-46290,\n    CVE-2022-46291, CVE-2022-46292, CVE-2022-46294,\n    CVE-2022-46295, CVE-2025-10994, CVE-2025-10995,\n    CVE-2025-10996, CVE-2025-10997, CVE-2025-10998,\n    CVE-2025-10999, CVE-2025-11000,\n    CVE-2026-2704 (boo#1258501), CVE-2026-2705 (boo#1258507) and\n    CVE-2026-3408 (boo#1259041)\n","status":"published","published":"2026-07-01T09:21:23Z","modified":"2026-07-03T18:24:23.69365859Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}