CVE-2024-9716
published 2024-11-22CVE-2024-9716: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary…
PriorityP343high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.30%
22.1th percentile
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24100.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| trimble | sketchup_viewer | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3vr8-mxjc-h34x: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
ghsa_unreviewed·2024-11-22
CVE-2024-9716 [HIGH] CWE-416 GHSA-3vr8-mxjc-h34x: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24100.
GHSA
Eclipse Jetty's PushSessionCacheFilter can cause remote DoS attacks
ghsa·2024-10-14
CVE-2024-6762 [LOW] CWE-400 Eclipse Jetty's PushSessionCacheFilter can cause remote DoS attacks
Eclipse Jetty's PushSessionCacheFilter can cause remote DoS attacks
### Impact
Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory.
### Patches
* https://github.com/jetty/jetty.project/pull/9715
* https://github.com/jetty/jetty.project/pull/9716
### Workarounds
The session usage is intrinsic to the design of the PushCacheFilter. The issue can be avoided by:
+ not using the PushCacheFilter. Push has been deprecated by the various IETF specs and early hints responses should be used instead.
+ reducing the reducing the idle timeout on unauthenticated sessions will reduce the time such session stay in memory.
+ configuring a session cache to use [session passivation](https://jetty.org/docs/jetty/12/programming
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-11-22
Published