ZDI-CAN-18979: ZDI-23-235: Unity Technologies Unity Editor DAE File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability

Published Mar 15, 2023

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unity Technologies Unity Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

Affected Software

1 affected component

Unity Technologies Unity Editor

Event History

Mar 15, 2023

Advisory Published

05:00 AM

Data Sourced

05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-18979?

ZDI-CAN-18979 is considered a critical vulnerability due to its potential for remote code execution.

How do I fix ZDI-CAN-18979?

To fix ZDI-CAN-18979, update your Unity Technologies Unity Editor to the latest version provided by the vendor.

What type of attack does ZDI-CAN-18979 facilitate?

ZDI-CAN-18979 facilitates remote code execution attacks that require user interaction to be successful.

What software versions are affected by ZDI-CAN-18979?

ZDI-CAN-18979 affects all installations of Unity Technologies Unity Editor without regard for specific version numbers.

Who is the vendor associated with ZDI-CAN-18979?

The vendor associated with ZDI-CAN-18979 is Unity Technologies.