PT-2022-27830 · Siemens · Solid Edge

Published 2022-12-13 · Updated 2023-03-14 · CVE-2022-46347

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parasolid versions prior to V33.1.264 Parasolid versions prior to V34.0.252 Parasolid versions prior to V34.1.242 Parasolid versions prior to V35.0.170 Solid Edge SE2022 versions prior to V222.0MP12 Solid Edge SE2023 versions prior to V223.0Update2

Description A vulnerability has been identified that allows an out of bounds write past the end of an allocated structure while parsing specially crafted X B files. This could allow an attacker to execute code in the context of the current process.

Recommendations For Parasolid versions prior to V33.1.264, update to version V33.1.264 or later. For Parasolid versions prior to V34.0.252, update to version V34.0.252 or later. For Parasolid versions prior to V34.1.242, update to version V34.1.242 or later. For Parasolid versions prior to V35.0.170, update to version V35.0.170 or later. For Solid Edge SE2022 versions prior to V222.0MP12, update to version V222.0MP12 or later. For Solid Edge SE2023 versions prior to V223.0Update2, update to version V223.0Update2 or later. As a temporary workaround, consider restricting the parsing of X B files until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-46347

ZDI-22-1680

Affected Products

Solid Edge

References · 5

• https://zerodayinitiative.com/advisories/ZDI-22-1680 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-588101.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46347 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46347 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf · Note