CVE-2020-6327: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

SAP 3D Visual Enterprise Viewer version 9 was found to contain a vulnerability that allows users to open manipulated 3DM files from untrusted sources. The vulnerability (CVE-2020-6327) was disclosed on September 9, 2020, and stems from improper input validation (NVD).

The vulnerability exists within the parsing of 3DM files and results from the lack of proper validation of user-supplied data, which can lead to an integer overflow before writing to memory. The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. The flaw is classified as CWE-190 (Integer Overflow or Wraparound) (NVD, ZDI).

When exploited, this vulnerability causes the application to crash and become temporarily unavailable until the user restarts the application. An attacker can potentially leverage this vulnerability to execute code in the context of the current process (ZDI).

The vulnerability requires user interaction to exploit, as the target must visit a malicious page or open a malicious file. The attack vector is network-based with low attack complexity, requiring no privileges but does need user interaction (NVD).

SAP has issued an update to correct this vulnerability. Users are advised to apply the security patch provided by SAP (ZDI).