CVSS: 9.3EPSS: 17%CPEs: 11EXPL: 2CVE-2013-7388
https://notcve.org/view.php?id=CVE-2013-7388
Heap-based buffer overflow in paintlib, as used in Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689), allows remote attackers to execute arbitrary code via a crafted RLE4-compressed bitmap (BMP). NOTE: this issue was SPLIT from CVE-2013-3664 due to different affected products and codebases (ADT1). Desbordamiento de buffer basado en memoria dinámica en paintlib, utilizado en Trimble SketchUp (anetriormente Google SketchUp) anterior a 2013 (13.0.3689), permite a atacantes remotos ejecutar código arbitrario a través de un mapa de bits RLE4-comprimido (BMP) manipulado. NOTA: este problema fue dividido (SPLIT) de CVE-2013-3664 debido a diferentes productos y bases de códigos afectados (ADT1). • http://blog.binamuse.com/2013/05/multiple-vulnerabilities-on-sketchup.html http://secunia.com/advisories/53635 http://www.binamuse.com/advisories/BINA-20130521B.txt http://www.securityfocus.com/bid/60248 https://exchange.xforce.ibmcloud.com/vulnerabilities/84723 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 4%CPEs: 1EXPL: 0CVE-2013-6038
https://notcve.org/view.php?id=CVE-2013-6038
Stack-based buffer overflow in Trimble SketchUp Viewer 13.0.4124 allows remote attackers to execute arbitrary code via a crafted .SKP file. Desbordamiento de búfer basado en pila en Trimble SketchUp Viewer 13.0.4124 permite a atacantes remotos ejecutar código arbitrario a través de un archivo .SKP. • http://osvdb.org/100988 http://www.kb.cert.org/vuls/id/586958 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 47%CPEs: 11EXPL: 3CVE-2013-3664
https://notcve.org/view.php?id=CVE-2013-3664
Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers an out-of-bounds stack write. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3662. NOTE: this issue was SPLIT due to different affected products and codebases (ADT1); CVE-2013-7388 has been assigned to the paintlib issue. Trimble SketchUp (anteriormente Google SketchUp) anterior a 2013 (13.0.3689) permite a atacantes remotos inyectar código arbitrario a través de una tabla de paleta de color en una textura MAC Pict, lo que provoca una escritura en pila fuera de rango. NOTA: está vulnerabilidad existe debido a una solución incompleta para CVE-2013-3662. • http://archives.neohapsis.com/archives/bugtraq/2013-06/0008.html http://blog.binamuse.com/2013/05/multiple-vulnerabilities-on-sketchup.html http://secunia.com/advisories/53635 http://www.binamuse.com/advisories/BINA-20130521A.txt http://www.securityfocus.com/bid/60248 https://exchange.xforce.ibmcloud.com/vulnerabilities/84723 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2012-5053
https://notcve.org/view.php?id=CVE-2012-5053
Cross-site scripting (XSS) vulnerability in the Receiver Web User Interface on Trimble Infrastructure GNSS Series Receivers NetR3, NetR5, NetR8, and NetR9 before 4.70, and NetRS before 1.3-2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el Receiver Web User Interface en Trimble Infrastructure GNSS Series Receivers NetR3, NetR5, NetR8, y NetR9 antes de v4.70, y NetR5 antes de v1.3-2, que permite a atacantes remotos inyectar un script web o HTML a través de vectores sin especificar. • http://archives.neohapsis.com/archives/bugtraq/2013-01/0063.html http://trl.trimble.com/docushare/dsweb/Get/Document-636664/NetRS_1%203-2_RelNotes.pdf http://trl.trimble.com/docushare/dsweb/Get/Document-644791/Infrastructure_GNSS-SeriesReceivers_4.70_RelNotes.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •