CVE-2020-6344: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

SAP 3D Visual Enterprise Viewer version 9 contains a vulnerability (CVE-2020-6344) that allows users to open manipulated PDF files received from untrusted sources, resulting in application crashes. The vulnerability was disclosed on September 9, 2020, and is caused by improper input validation (NVD, ZDI).

The vulnerability stems from the lack of proper validation of user-supplied values prior to dereferencing them as pointers during PDF file parsing. The issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. The weakness has been classified as CWE-20: Improper Input Validation (NVD, ZDI).

When exploited, this vulnerability causes the application to crash and become temporarily unavailable until the user restarts the application. The impact is limited to availability, with no direct effects on confidentiality or integrity (NVD).

The vulnerability requires user interaction to exploit, specifically requiring the target to open a malicious PDF file. An attacker can leverage this vulnerability to cause a denial of service condition in the context of the current process (ZDI).

SAP has issued an update to correct this vulnerability. Users are advised to apply the security patches provided by SAP (ZDI).