PT-2022-17523 · Autodesk · Autodesk Trueview

Published 2022-03-07 · Updated 2022-10-11 · CVE-2022-25795

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Autodesk TrueView versions 2021 through 2022

Description A memory corruption issue may lead to remote code execution through maliciously crafted DWG files. This can occur when parsing DWG files, allowing an attacker to write beyond the allocated buffer and potentially execute arbitrary code.

Recommendations For Autodesk TrueView versions 2021 and 2022, update to a version that includes the fix for this issue to prevent remote code execution through malicious DWG files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2022-25795

ZDI-22-467

ZDI-22-468

ZDI-22-469

ZDI-22-472

ZDI-22-548

ZDI-22-549

ZDI-22-550

ZDI-22-551

ZDI-22-552

ZDI-22-555

ZDI-22-556

Affected Products

Autodesk Trueview

References · 16

• https://zerodayinitiative.com/advisories/ZDI-22-468 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-555 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-549 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-472 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-551 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25795 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-550 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-548 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-467 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-469 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-552 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-25795 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2022-0007 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-556 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2021-0010%3B · Note