PT-2014-2918 · Autodesk+1 · Autodesk Sketchbook Copic Edition+4

Published 2014-04-02 · Updated 2014-04-05 · CVE-2013-5365

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Autodesk SketchBook for Enterprise versions prior to 6.25 Autodesk SketchBook Pro versions prior to 6.25 Autodesk SketchBook Express versions prior to 6.25 Autodesk SketchBook Copic Edition versions prior to 2.0.2

Description The issue allows remote attackers to execute arbitrary code via RLE-compressed channel data in a PSD file. This is due to a heap-based buffer overflow.

Recommendations For Autodesk SketchBook for Enterprise versions prior to 6.25, update to version 6.25 or later. For Autodesk SketchBook Pro versions prior to 6.25, update to version 6.25 or later. For Autodesk SketchBook Express versions prior to 6.25, update to version 6.25 or later. For Autodesk SketchBook Copic Edition versions prior to 2.0.2, update to version 2.0.2 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2013-5365

Affected Products

Autodesk Sketchbook Copic Edition

Autodesk Sketchbook Express

Autodesk Sketchbook Pro

Autodesk Sketchbook For Enterprise

Psd

References · 4

• http://sketchbook.com/news/important-security-update-for-sketchbook.html · Vendor Advisory
• http://secunia.com/advisories/55000 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-5365 · Security Note
• http://secunia.com/secunia_research/2014-5 · Vendor Advisory