PT-2024-3626 · Siemens · Parasolid

Published 2024-05-14 · Updated 2024-05-14 · CVE-2024-31980

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Parasolid versions prior to V35.1.256 Parasolid versions prior to V36.0.210 Parasolid versions prior to V36.1.185

Description: A vulnerability has been identified in the affected application, which contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted X T part file. This could allow an attacker to execute code in the context of the current process.

Recommendations: For versions prior to V35.1.256, update to a version equal to or later than V35.1.256. For versions prior to V36.0.210, update to a version equal to or later than V36.0.210. For versions prior to V36.1.185, update to a version equal to or later than V36.1.185.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2024-03945

CVE-2024-31980

Affected Products

Parasolid

References · 5

• https://cert-portal.siemens.com/productcert/html/ssa-489698.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-31980 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31980 · Security Note
• https://bdu.fstec.ru/vul/2024-03945 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2024-05-17.1.pdf · Security Note