CVE-2017-12939: Input Validation

Published Aug 18, 2017

Updated

A Remote Code Execution vulnerability was identified in all Windows versions of Unity Editor, e.g., before 5.3.8p2, 5.4.x before 5.4.5p5, 5.5.x before 5.5.4p3, 5.6.x before 5.6.3p1, and 2017.x before 2017.1.0p4.

Affected Software

15 affected components

unity3d Unity Editor=5.3.8

unity3d Unity Editor=5.4.0

unity3d Unity Editor=5.4.1

unity3d Unity Editor=5.4.2

unity3d Unity Editor=5.4.3

unity3d Unity Editor=5.4.4

unity3d Unity Editor=5.5.0

unity3d Unity Editor=5.5.1

unity3d Unity Editor=5.5.2

unity3d Unity Editor=5.5.3

unity3d Unity Editor=5.6.0

unity3d Unity Editor=5.6.1

unity3d Unity Editor=5.6.2

unity3d Unity Editor=2017.1.0

Microsoft Windows

Remediation

Patch Available

https://unity3d.com/security#issues

Event History

Aug 18, 2017

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2017-12939?

CVE-2017-12939 is classified as a Remote Code Execution vulnerability.

How do I fix CVE-2017-12939?

To mitigate CVE-2017-12939, upgrade to a patched version of Unity Editor that is beyond the vulnerable versions listed.

Which versions of Unity Editor are affected by CVE-2017-12939?

CVE-2017-12939 affects Unity Editor versions before 5.3.8p2, 5.4.x before 5.4.5p5, 5.5.x before 5.5.4p3, 5.6.x before 5.6.3p1, and 2017.x before 2017.1.0p4.

What does CVE-2017-12939 allow an attacker to do?

CVE-2017-12939 allows an attacker to execute arbitrary code on a user's machine via the Unity Editor.

Is my version of Windows affected by CVE-2017-12939?

No, CVE-2017-12939 specifically affects all Windows versions of Unity Editor, but does not impact the Windows operating system itself.