Skip to content
OpenAdvisories
Medium WID-SEC-2025-0439 2 CVEs

ESRI ArcGIS: Mehrere Schwachstellen ermöglichen Codeausführung

Published Feb 25, 2025 · Updated Feb 25, 2025 · de-DE

Vendor: Esri Product: ArcGIS Platform: Windows

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in ESRI ArcGIS ausnutzen, um beliebigen Programmcode auszuführen.

Product

ArcGIS ist ein Geoinformationssystem.

Vulnerabilities 2

  • High 7.3
    CVE-2025-1067

    There is a code injection vulnerability in ArcGIS Pro

    There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific a…

    Esri ArcGIS Pro
  • High 7.3
    CVE-2025-1068

    There is a code injection vulnerability in Esri ArcGIS AllSource

    There is an untrusted search path vulnerability in Esri ArcGIS AllSource 1.2 and 1.3 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a spec…

    Esri ArcGIS AllSource

Revision history

  1. #1

    Initiale Fassung

References

  • ArcGIS Blog vom 2025-02-25
    https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-pro-and-arcgis-allsource-patches-address-high-severity-vulnerabilities/