ZDI-24-189: Trimble SketchUp SKP File Parsing Use-After-Free Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-189?
The severity of ZDI-24-189 is classified as medium, indicating a potential risk for sensitive information disclosure.
How do I fix ZDI-24-189?
To fix ZDI-24-189, users should update to the latest version of Trimble SketchUp as provided by the vendor.
Who is affected by ZDI-24-189?
ZDI-24-189 affects installations of Trimble SketchUp where users might visit malicious pages or open harmful files.
Is user interaction required to exploit ZDI-24-189?
Yes, user interaction is required for exploiting ZDI-24-189, as the target must visit a malicious site or file.
What type of vulnerability is ZDI-24-189?
ZDI-24-189 is a remote information disclosure vulnerability that could expose sensitive data.