PT-2023-2742 · Adobe · Substance3D - Painter

Published 2023-05-09 · Updated 2023-05-17 · CVE-2023-29286

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe Substance 3D Painter versions 8.3.0 and earlier

Description The issue is related to an Access of Uninitialized Pointer vulnerability. This could allow an attacker to disclose sensitive memory and potentially bypass mitigations like ASLR. Exploitation requires user interaction, where a victim must open a malicious file.

Recommendations For versions 8.3.0 and earlier, update to a version that contains a fix for this issue to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

BDU:2023-02589

CVE-2023-29286

ZDI-23-566

Affected Products

Substance3D - Painter

References · 7

• https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-566 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-29286 · Security Note
• https://bdu.fstec.ru/vul/2023-02589 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29286 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB20230509127 · Note
• https://t.me/cibsecurity/63949 · Telegram Post