SB2022101240 - Multiple vulnerabilities in Altair HyperView Player
Published: October 12, 2022 Updated: October 17, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2022-2947)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Use of uninitialized resource (CVE-ID: CVE-2022-2949)
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to usage of uninitialized resources when parsing the H3D files. A remote attacker can trick a victim to open a specially crafted H3D file, trigger uninitialized usage of resources and execute arbitrary code on the target system.
3) Use of uninitialized resource (CVE-ID: CVE-2022-2950)
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to usage of uninitialized resources when parsing the H3D files. A remote attacker can trick a victim to open a specially crafted H3D file, trigger uninitialized usage of resources and execute arbitrary code on the target system.
4) Improper Validation of Array Index (CVE-ID: CVE-2022-2951)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a improper validation of array index when processing the H3D files. A remote attacker can execute arbitrary code on the target system.
Remediation
Install update from vendor's website.