Multiple vulnerabilities in Altair HyperView Player
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 4 |
| CVE-ID | CVE-2022-2947 CVE-2022-2949 CVE-2022-2950 CVE-2022-2951 |
| CWE-ID | CWE-119 CWE-908 CWE-129 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
HyperView Player Client/Desktop applications / Other client software |
| Vendor | Altair Engineering |
Security Bulletin
This security bulletin contains information about 4 vulnerabilities.
1) Buffer overflow
EUVDB-ID: #VU68250
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-2947
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsHyperView Player: 2021.1.0.27
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-22-284-01
http://www.zerodayinitiative.com/advisories/ZDI-22-1435/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Use of uninitialized resource
EUVDB-ID: #VU68251
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-2949
CWE-ID:
CWE-908 - Use of Uninitialized Resource
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to usage of uninitialized resources when parsing the H3D files. A remote attacker can trick a victim to open a specially crafted H3D file, trigger uninitialized usage of resources and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsHyperView Player: 2021.1.0.27
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-22-284-01
http://www.zerodayinitiative.com/advisories/ZDI-22-1436/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Use of uninitialized resource
EUVDB-ID: #VU68252
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-2950
CWE-ID:
CWE-908 - Use of Uninitialized Resource
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to usage of uninitialized resources when parsing the H3D files. A remote attacker can trick a victim to open a specially crafted H3D file, trigger uninitialized usage of resources and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsHyperView Player: 2021.1.0.27
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-22-284-01
http://www.zerodayinitiative.com/advisories/ZDI-22-1437/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Improper Validation of Array Index
EUVDB-ID: #VU68253
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-2951
CWE-ID:
CWE-129 - Improper Validation of Array Index
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a improper validation of array index when processing the H3D files. A remote attacker can execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsHyperView Player: 2021.1.0.27
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-22-284-01
http://www.zerodayinitiative.com/advisories/ZDI-22-1438/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
