Panda3D vulnerabilities

The egg-mkfont utility in Panda3D up to version 1.10.16 contains a stack-based buffer overflow vulnerability due to an unbounded sprintf() call with attacker-controlled input. When constructing glyph filenames, egg-mkfont formats a user-supplied glyph pattern (-gp) into a fixed-size stack buffer without length validation.

The egg-mkfont utility in Panda3D up to version 1.10.16 contains an uncontrolled format string vulnerability. The -gp (glyph pattern) option is used directly as the format string for sprintf() with only one argument, allowing an attacker to read stack values and write them into .egg and .png files.

The deploy-stub component in Panda3D up to version 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation. The alloca() function allocates memory for argv_copy and argv_copy2 based on attacker-controlled argc without validation. Supplying a large number of command-line arguments can exhaust stack space and propagate uninitialized stack memory into Python interpreter initialization, causing a reliable crash and undefined behavior.