CVE-2013-3664

Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers an out-of-bounds stack write. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3662. NOTE: this issue was SPLIT due to different affected products and codebases (ADT1); CVE-2013-7388 has been assigned to the paintlib issue.

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

29.78% chance of exploitation in the next 30 days, 98th percentile

Published

2014-07-01

Updated

2024-08-06

Proof-of-concept exploits (4)

• defrancescojp/CVE-2013-3664_BMP0★ · 2020-11-13
• defrancescojp/CVE-2013-3664_MAC0★ · 2020-11-13
• lagartojuancho/CVE-2013-3664_BMP0★ · 2020-11-13
• lagartojuancho/CVE-2013-3664_MAC0★ · 2020-11-13

References

• CVE Record
• NVD entry

Related

• CVE-2013-2977
• CVE-2013-3661
• CVE-2013-3684
• CVE-2013-3660
• CVE-2013-3685
• CVE-2013-3651