CVE-2024-1848: Dassault Systèmes SOLIDWORKS Desktop, грешка в паметта

Описание

Оригинално описание

Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Use-After-Free vulnerabilities exist in the file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted CATPART, DWG, DXF, IPT, JT, SAT, SLDDRW, SLDPRT, STL, STP, X_B or X_T file.

Засегнати продукти

• Dassault Systèmes SOLIDWORKS Desktop: Release SOLIDWORKS 2024 SP0 до Release SOLIDWORKS 2024 SP1
• 3ds 3dexperience_solidworks: 2024 до 2024_sp1

Вид слабост

• CWE-416 Използване на памет след освобождаване (Use-After-Free)
• CWE-787 Out-of-bounds Write
• CWE-125 Четене извън границите на буфера
• CWE-843 Access of Resource Using Incompatible Type
• CWE-908 Use of Uninitialized Resource
• CWE-122 Препълване на буфера в хийпа
• CWE-457 Използване на неинициализирана променлива

История

Други уязвимости в Dassault Systèmes SOLIDWORKS Desktop

• 7.8CVE-2026-3476
• 7.8CVE-2023-2763
• 7.8CVE-2023-2762

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2024-1848
• https://nvd.nist.gov/vuln/detail/CVE-2024-1848
• https://www.3ds.com/vulnerability/advisories