Vectors2Final

**Name of the Vulnerable Software and Affected Versions** Trimble SketchUp Viewer (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this issue, where the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files, resulting from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this issue to execute code in the context of the current process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Maxon Cinema 4D (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Maxon Cinema 4D. It requires user interaction, where the target must visit a malicious page or open a malicious file. The flaw exists within the parsing of SKP files due to the lack of validating the existence of an object prior to performing operations on it. An attacker can leverage this to execute code in the context of the current process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Open Design Alliance Drawings SDK versions prior to 2024.1 **Description** An issue was discovered in the Open Design Alliance Drawings SDK where a crafted DWG file can force the SDK to reuse an object that has been freed. This can be leveraged by an attacker in conjunction with other issues to execute arbitrary code. **Recommendations** For versions prior to 2024.1, update to version 2024.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Open Design Alliance Drawings SDK versions prior to 2023.6 **Description** The issue is related to a heap-based buffer overflow in the parsing of DWG files. This occurs due to a lack of proper validation of the length of user-supplied XRecord data before it is copied to a fixed-length heap-based buffer. An attacker can exploit this to execute code in the context of the current process. **Recommendations** For versions prior to 2023.6, update to version 2023.6 or later to resolve the issue. As a temporary workaround, consider restricting the parsing of DWG files from untrusted sources until a patch is applied. Avoid using the `XRecord` data in the affected parsing functionality until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Open Design Alliance Drawings SDK versions prior to 2023.6 **Description** The issue is related to a heap-based buffer overflow in the DXF file reading procedure. This occurs due to the lack of proper validation of the length of user-supplied XRecord data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. The vulnerability can be exploited using specially crafted DXF files. **Recommendations** For Open Design Alliance Drawings SDK versions prior to 2023.6, update to version 2023.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of DXF files from untrusted sources until the update is applied. Avoid using the `XRecord` data in the affected DXF file parsing procedure until the issue is resolved.