A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP4). Affected applications lack proper validation of user-supplied data when parsing DFT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12049)
References
| Link | Resource |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-574442.pdf | Patch Vendor Advisory |
| https://cert-portal.siemens.com/productcert/pdf/ssa-715184.pdf | Patch Vendor Advisory |
| https://us-cert.cisa.gov/ics/advisories/icsa-21-103-06 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
|
History
10 Dec 2021, 21:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://us-cert.cisa.gov/ics/advisories/icsa-21-103-06 - Third Party Advisory, US Government Resource | |
| References | (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-574442.pdf - Patch, Vendor Advisory | |
| References | (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-715184.pdf - Patch, Vendor Advisory | |
| CPE | cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:* cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack2:*:*:*:*:*:* cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack7:*:*:*:*:*:* cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack12:*:*:*:*:*:* cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack11:*:*:*:*:*:* cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack4:*:*:*:*:*:* cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack3:*:*:*:*:*:* cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:* cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack9:*:*:*:*:*:* cpe:2.3:a:siemens:solid_edge:se2020:-:*:*:*:*:*:* cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack10:*:*:*:*:*:* cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack5:*:*:*:*:*:* cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:* cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack2:*:*:*:*:*:* cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack6:*:*:*:*:*:* cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack1:*:*:*:*:*:* cpe:2.3:a:siemens:solid_edge:se2020:maintenance_pack8:*:*:*:*:*:* |
15 Jul 2021, 18:00
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack3:*:*:*:*:*:* |
22 Apr 2021, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP4). Affected applications lack proper validation of user-supplied data when parsing DFT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12049) |
16 Apr 2021, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
13 Apr 2021, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Mar 2021, 20:02
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:siemens:solid_edge:se2021:mp3:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : 6.8
v3 : 7.8 |
| References | (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-715184.pdf - Vendor Advisory |
15 Mar 2021, 18:00
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-03-15 17:15
Updated : 2023-12-10 13:41
NVD link : CVE-2020-28385
Mitre link : CVE-2020-28385
CVE.ORG link : CVE-2020-28385
JSON object : View
Products Affected
siemens
- solid_edge
CWE
CWE-787
Out-of-bounds Write