Buffer overflow in Google Sketchup
CVE-2013-3664
Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers an out-of-bounds stack write. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3662. NOTE: this issue was SPLIT due to different affected products and codebases (ADT1); CVE-2013-7388 has been assigned to the paintlib issue.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v2 metric
CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.298 (98.1th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.298 · newest: 0.298 · change: 0.000
Affected products
- Google Sketchup — versions 6.0, 7.0, 7.1
- Trimble Sketchup
Weakness classification (CWE)
Public proof-of-concept exploits
References
- archives.neohapsis.com/archives/bugtraq/2013-06/0008.html (mailing-list, Exploit)
- www.binamuse.com/advisories/BINA-20130521A.txt (Exploit)
- exchange.xforce.ibmcloud.com/vulnerabilities/84723 (vdb-entry)
- www.securityfocus.com/bid/60248 (vdb-entry)
- blog.binamuse.com/2013/05/multiple-vulnerabilities-on-sketchup.html (Exploit)
- secunia.com/advisories/53635 (third-party-advisory)
Frequently asked questions
- What is CVE-2013-3664?
- CVE-2013-3664 is a vulnerability in Google Sketchup, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2014-07-01.
- Is CVE-2013-3664 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.