CVE-2020-6361: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

CVE-2020-6361 is a vulnerability discovered in SAP 3D Visual Enterprise Viewer version 9. The vulnerability was reported on July 10, 2020, and publicly disclosed on September 10, 2020. This security flaw affects the parsing of RLE files and stems from improper validation of user-supplied data (ZDI Advisory).

The vulnerability is classified with a CVSS score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The specific issue exists within the parsing of RLE files, where lack of proper validation of user-supplied data can result in a write past the end of an allocated buffer (ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The attack requires user interaction, specifically opening a malicious file or visiting a malicious page (ZDI Advisory).

The vulnerability requires user interaction to exploit, where the target must visit a malicious page or open a malicious file. The attack can be initiated remotely but requires local user interaction (ZDI Advisory).

SAP has released an update to address this vulnerability. Users are advised to apply the security patch provided by SAP (ZDI Advisory).