Summary
Solid Edge is affected by multiple memory corruption vulnerabilities that could be triggered when the application reads specially crafted files in various formats such as DWG, IFC, OBJ or STP format. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to crash the application or execute arbitrary code.
Siemens has released several updates for Solid Edge SE2023 and recommends to update to the latest version.
Vulnerabilities 4
-
High 7.8
A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 3), Solid Edge SE2023 (All versi…
-
High 7.8
A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 2). The affected application con…
-
Low 3.3
A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 3), Solid Edge SE2023 (All versi…
-
Low 2.2
Step Tools Third-Party
STEPTools v18SP1 ifcmesh library (v18.1) is affected due to a null pointer dereference, which could allow an attacker to deny application usage when reading a specially constructed file, resulting in an application crash.
Revision history
-
#2
Added CVE-2023-39549 fixed in Solid Edge 223.0 Update 2
-
#1
Publication Date
References
-
SSA-932528: Multiple File Parsing Vulnerabilities in Solid Edge - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-932528.html
-
SSA-932528: Multiple File Parsing Vulnerabilities in Solid Edge - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-932528.pdf
-
SSA-932528: Multiple File Parsing Vulnerabilities in Solid Edge - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-932528.txt