CVE-2022-46345

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-46345
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2022 (All versions), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds write past the end of an allocated structure while parsing specially crafted X_B files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19070)

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-588101.pdf Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:siemens:solid_edge_se2022:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2023:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2023:223.0:-:*:*:*:*:*:*
History

02 Feb 2024, 16:25

Type Values Removed Values Added
CPE cpe:2.3:a:siemens:solid_edge_se2023:-:*:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2022:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:solid_edge_se2023:223.0:-:*:*:*:*:*:*
First Time Siemens solid Edge Se2023
Siemens solid Edge Se2022
References () https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf - () https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf - Vendor Advisory

14 Mar 2023, 10:15

Type Values Removed Values Added
Summary A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Solid Edge SE2022 (All versions < V2210Update12), Solid Edge SE2022 (All versions), Solid Edge SE2023 (All versions < V2023Update2). The affected applications contain an out of bounds write past the end of an allocated structure while parsing specially crafted X_B files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19070) A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2022 (All versions), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds write past the end of an allocated structure while parsing specially crafted X_B files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19070)

14 Feb 2023, 11:15

Type Values Removed Values Added
References
  • (MISC) https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf -
Summary A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170). The affected applications contain an out of bounds write past the end of an allocated structure while parsing specially crafted X_B files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19070) A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Solid Edge SE2022 (All versions < V2210Update12), Solid Edge SE2022 (All versions), Solid Edge SE2023 (All versions < V2023Update2). The affected applications contain an out of bounds write past the end of an allocated structure while parsing specially crafted X_B files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19070)

15 Dec 2022, 20:41

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-787
CPE cpe:2.3:a:siemens:parasolid:*:*:*:*:*:*:*:*
First Time Siemens parasolid
Siemens
References (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-588101.pdf - (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-588101.pdf - Vendor Advisory

13 Dec 2022, 16:52

Type Values Removed Values Added
New CVE
Information

Published : 2022-12-13 16:15

Updated : 2024-02-02 16:25

NVD link : CVE-2022-46345

Mitre link : CVE-2022-46345

CVE.ORG link : CVE-2022-46345

JSON object : View

Products Affected

siemens

  • solid_edge_se2022
  • solid_edge_se2023
  • parasolid
CWE
CWE-787

Out-of-bounds Write