CVE-2016-2536
high
CVSS v3
8.8
CVSS v4 NEW
—
VIR risk
8.8
Description
Multiple use-after-free vulnerabilities in SAP 3D Visual Enterprise Viewer allow remote attackers to execute arbitrary code via a crafted SketchUp document. NOTE: the primary affected product may be SketchUp.
Predictions
Exploit likelihood
92%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| sap | 3d_visual_enterprise_viewer | | |
| sketchup | | |
References
- http://www.securityfocus.com/bid/83307
- http://www.zerodayinitiative.com/advisories/ZDI-16-173
- http://www.zerodayinitiative.com/advisories/ZDI-16-174
- http://www.zerodayinitiative.com/advisories/ZDI-16-175
- http://www.zerodayinitiative.com/advisories/ZDI-16-176
- http://www.securityfocus.com/bid/83307
- http://www.zerodayinitiative.com/advisories/ZDI-16-173
- http://www.zerodayinitiative.com/advisories/ZDI-16-174
- http://www.zerodayinitiative.com/advisories/ZDI-16-175
- http://www.zerodayinitiative.com/advisories/ZDI-16-176
CWEs
CWE-399
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.