CVE-2013-3664

CVE-2013-3664 affects Trimble SketchUp (formerly Google SketchUp) before version 13.0.3689. It permits remote code execution via a crafted color palette table in a MAC Pict texture, causing an out-of-bounds stack write. This CVE exists due to an incomplete fix for CVE-2013-3662 and was split from...

CVE-2013-3663

SketchUp before 8 Maintenance 3 is affected by CVE-2013-3663 (BMP RLE8 Heap Overflow) due to a heap overflow in the BMP RLE8 decoding path borrowed from paintlib. The vulnerability allows remote code execution by parsing a crafted BMP texture embedded in a SKP file; the issue is fixed in 8M3 (and...

CVE-2011-2478

Summary of CVE-2011-2478 : Google SketchUp prior to 8.0 is affected by a remote code execution vulnerability in the handling of edge geometry in SKP files. A crafted .SKP file may cause arbitrary code execution within the SketchUp process (untrusted file). Affected product/version: SketchUp befor...

CVE-2013-3662

CVE-2013-3662 affects Timbre SketchUp/Google SketchUp prior to 8 Maintenance 2. A crafted color palette table in a MAC Pict texture can trigger a stack-based buffer overflow, allowing remote arbitrary code execution. Impact is consistent with a high-severity, network-accessible vulnerability (as ...

CVE-2013-7388

The CVE-2013-7388 entry describes a heap-based buffer overflow in the paintlib component used by Trimble SketchUp prior to version 13.0.3689, exploitable via a crafted RLE4 BMP. This affects SketchUp’s use of paintlib; the issue is described as a heap overflow enabling remote code execution. The ...

CVE-2016-2536

CVE-2016-2536 concerns multiple use-after-free vulnerabilities in SAP 3D Visual Enterprise Viewer, exploitable via crafted SketchUp documents. The primary affected product is likely SketchUp. The ZDI advisories describe a remote code execution flaw that requires user interaction (target must open...

CVE-2012-4894

CVE-2012-4894 affects Google SketchUp prior to 8.0.14346 (8 Maintenance 3). The vulnerability allows user-assisted remote attackers to execute arbitrary code or cause a denial of service via a crafted SKP file, due to memory corruption when parsing SKP content. OpenVAS/NVD entries corroborate the...