PT-2022-27832 · Siemens · Solid Edge+1

Published 2022-12-13 · Updated 2023-03-14 · CVE-2022-46349

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parasolid versions prior to V33.1.264 Parasolid versions prior to V34.0.252 Parasolid versions prior to V34.1.242 Parasolid versions prior to V35.0.170 Solid Edge SE2022 versions prior to V222.0MP12 Solid Edge SE2023 versions prior to V223.0Update2

Description The issue arises from an out of bounds read past the end of an allocated structure while parsing specially crafted X B files. This could allow an attacker to execute code in the context of the current process.

Recommendations For Parasolid versions prior to V33.1.264, update to version V33.1.264 or later. For Parasolid versions prior to V34.0.252, update to version V34.0.252 or later. For Parasolid versions prior to V34.1.242, update to version V34.1.242 or later. For Parasolid versions prior to V35.0.170, update to version V35.0.170 or later. For Solid Edge SE2022 versions prior to V222.0MP12, update to version V222.0MP12 or later. For Solid Edge SE2023 versions prior to V223.0Update2, update to version V223.0Update2 or later.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2022-46349

ZDI-22-1681

Affected Products

Parasolid

Solid Edge

References · 5

• https://cert-portal.siemens.com/productcert/pdf/ssa-588101.pdf · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1681 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-46349 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46349 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf · Note