CVE-2023-2763
Assigner: 3DS
Published: 2023-07-12T07:05:33.333Z
State: PUBLISHED
title: Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023
problemTypes: descriptions: cweId: CWE-416
description: CWE-416 Use After Free
type: CWE
descriptions: cweId: CWE-787
description: CWE-787 Out-of-bounds Write
type: CWE
affected: vendor: Dassault Systèmes
product: SOLIDWORKS Desktop
versions: status: affected
version: Release SOLIDWORKS 2021 Golden
lessThanOrEqual: Release SOLIDWORKS 2021 SP5.1
versionType: custom
status: affected
version: Release SOLIDWORKS 2022 Golden
lessThanOrEqual: Release SOLIDWORKS 2022 SP5
versionType: custom
status: affected
version: Release SOLIDWORKS 2023 Golden
lessThanOrEqual: Release SOLIDWORKS 2023 SP2
versionType: custom
defaultStatus: unaffected
descriptions: value: Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted DWG or DXF file.
supportingMedia: type: text/html
base64: no
value: Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted DWG or DXF file.
metrics: format: CVSS
scenarios: value: GENERAL
cvssV3_1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
source: discovery: EXTERNAL
x_generator: engine: Vulnogram 0.1.0-dev
credits: value: Mat Powell from Trend Micro's Zero Day Initiative
user: 00000000-0000-4000-9000-000000000000
type: finder