CVE-2022-40647

CVE-2022-40647 affects Ansys SpaceClaim 2022 R1. The flaw is in parsing X_B files, caused by insufficient validation, leading to an out-of-bounds read that can allow code execution in the target process. User interaction is required (target must open a malicious file/page). Multiple sources refer...

CVE-2023-42131

CVE-2023-42131 targets Ansys SpaceClaim, exploiting an out-of-bounds write in the parsing of X_B files. The flaw arises from insufficient validation of user-supplied data, allowing an attacker to write past the end of an allocated data structure and execute arbitrary code in the target process. E...

CVE-2022-40642

CVE-2022-40642 affects Ansys SpaceClaim 2022 R1. The vulnerability is in the parsing of X_B files and arises from a lack of proper initialization of a pointer before use, allowing remote code execution with user interaction required (target must open a malicious page or file). Documented by ZDI a...

CVE-2022-40641

CVE-2022-40641 affects Ansys SpaceClaim 2022 R1. The issue is an out-of-bounds write in the parsing of X_B files, caused by inadequate validation of user-supplied data, which can allow code execution in the context of the current process. Exploitation requires user interaction (the target must vi...

CVE-2022-40649

CVE-2022-40649 affects Ansys SpaceClaim 2022 R1. The vulnerability stems from parsing X_B files where a pointer is not properly initialized, enabling a remote code execution when a user visits a malicious page or opens a malicious file. Exploitation requires user interaction and is actionable in ...

CVE-2022-40636

CVE-2022-40636 affects Ansys SpaceClaim 2022 R1. The root cause is a parsing flaw in JT files that allows reading beyond allocated buffers, enabling remote code execution. Exploitation requires user interaction (target visits a malicious page or opens a malicious file). The vulnerability is docum...

CVE-2022-40648

CVE-2022-40648 affects Ansys SpaceClaim 2022 R1. The vulnerability resides in the parsing of X_B files, where insufficient validation leads to a write before the start of an allocated data structure, enabling arbitrary code execution. Exploitation requires user interaction (visit a malicious page...

CVE-2022-40638

CVE-2022-40638 affects Ansys SpaceClaim 2022 R1. The flaw is in parsing of X_B files where code can run without validating whether an object exists, enabling a remote code execution when a user opens a malicious file or visits a malicious page. The issue is a use-after-free-like condition that ca...

CVE-2022-40640

CVE-2022-40640 affects Ansys SpaceClaim 2022 R1. The flaw is in parsing of X_B files, causing a read-before-start of an allocated data structure and enabling code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious file); advisories (e.g., ZDI-22-11...

CVE-2022-40653

CVE-2022-40653 affects Ansys SpaceClaim 2022 R1. The vulnerability is in the parsing of X_B files, caused by insufficient validation that can trigger a write past the end of an allocated data structure, enabling code execution in the context of the current process. Exploitation requires user inte...

CVE-2022-40644

CVE-2022-40644 involves Ansys SpaceClaim 2022 R1 where the X_B file parser lacks proper validation, causing an out-of-bounds write and enabling remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). The issue is tied to ZDI-CAN-17408...

CVE-2022-40650

CVE-2022-40650 affects Ansys SpaceClaim 2022 R1. The vulnerability arises from parsing X_B files, where insufficient validation of user-supplied data leads to a write past the end of an allocated data structure. This can enable remote attackers to execute arbitrary code in the context of the curr...

CVE-2022-40652

CVE-2022-40652 affects Ansys SpaceClaim 2022 R1 and involves a parsing flaw in X_B files. The issue allows an attacker to execute arbitrary code with the current process context by exploiting a write past the end of an allocated data structure during parsing. Exploitation requires user interactio...

CVE-2022-40643

CVE-2022-40643 affects Ansys SpaceClaim 2022 R1. The issue is an uninitialized pointer in the parsing of X_B files, enabling remote code execution with user interaction (target must visit a malicious page or open a malicious file). Referenced advisories (e.g., ZDI-22-1199) document this vector. N...

CVE-2022-40651

Ansys SpaceClaim 2022 R1 is affected by a vulnerability in parsing of X_B files, caused by insufficient validation that allows a write past the end of an allocated data structure. This can enable remote code execution with user interaction (target must visit a malicious page or open a malicious f...

CVE-2022-40639

CVE-2022-40639 affects Ansys SpaceClaim 2022 R1. The vulnerability is a use-after-free in the SKP file parsing path caused by not validating object existence before operations, enabling remote code execution when a user visits a malicious page or opens a malicious file. Exploitation requires user...

CVE-2022-40637

This CVE-2022-40637 affects Ansys SpaceClaim 2022 R1 and involves a JT file parsing flaw. The root cause is failure to validate the existence of an object before performing operations on it, enabling an attacker to achieve remote code execution with the current process context after user interact...

CVE-2022-40646

CVE-2022-40646 affects Ansys SpaceClaim 2022 R1. The root cause is an uninitialized pointer during parsing of X_B files, allowing remote code execution when a user visits a malicious page or opens a malicious file. Exploitation requires user interaction and can execute code in the context of the ...

CVE-2022-40654

CVE-2022-40654 affects Ansys SpaceClaim 2022 R1. Root cause: improper validation during parsing of X_T files leads to a write past end of allocated data, enabling remote code execution with user interaction (target must visit a malicious page or open a malicious file). Descriptions in multiple so...

CVE-2022-40645

CVE-2022-40645 affects Ansys SpaceClaim 2022 R1. Root cause: uninitialized pointer in the parsing of X_B files, leading to arbitrary code execution. Exploitation requires user interaction (target must visit a crafted page or open a malicious file). CVSS data in the initial documents indicates a H...