PT-2021-3515 · Autodesk · Autodesk Design Review

Published 2021-01-29 · Updated 2022-05-12 · CVE-2021-27037

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Autodesk Design Review versions 2011 through 2018

Description The issue is related to the parsing of PNG, PDF, or DWF files, which can lead to a use-after-free condition, allowing remote malicious actors to execute arbitrary code. This can occur when a maliciously crafted file is used to attempt to free an object that has already been freed.

Recommendations For Autodesk Design Review versions 2011 through 2018, update to a version that includes a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2021-03564

CVE-2021-27037

ZDI-21-1319

ZDI-21-717

ZDI-21-719

ZDI-21-740

ZDI-22-459

Affected Products

Autodesk Design Review

References · 14

• https://zerodayinitiative.com/advisories/ZDI-22-459 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27037 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27037 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-717 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-740 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-719 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2022-0004 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-1319 · Security Note
• https://bdu.fstec.ru/vul/2021-03564 · Security Note
• https://safe-surf.ru/upload/VULN/VULN-20210701.4.pdf · Security Note
• https://cybersecurity-help.cz/vdb/SB2021062401 · Note
• https://securitylab.ru/vulnerability/521602.php · Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2021-0003 · Note
• https://t.me/cvenotify/17478 · Telegram Post