CVE-2024-23138

高 7.8CVE-2024-23138 · 18/03/2024 公開 · 17/06/2026 更新

要点

CVE-2024-23138 は advance steel (autodesk), autocad (autodesk), autocad architecture (autodesk) に影響する深刻度「高」 (CVSS 7.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.47%（全脆弱性の 40.6% より高い）。
対処：2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
advance steel autodesk	`≥ 2021, < 2021.1.4≥ 2022, < 2022.1.4≥ 2023, < 2023.1.5≥ 2024, < 2024.1.3`	`2021.1.42022.1.42023.1.52024.1.3`
autocad autodesk	`≥ 2021, < 2021.1.4≥ 2022, < 2022.1.4≥ 2022, < 2022.4.1≥ 2023, < 2023.1.5≥ 2023, < 2023.3.1≥ 2024, < 2024.1.2≥ 2024, < 2024.1.3`	`2021.1.42022.1.42022.4.12023.1.52023.3.12024.1.22024.1.3`
autocad architecture autodesk	`≥ 2021, < 2021.1.4≥ 2022, < 2022.1.4≥ 2023, ≤ 2023.1.5≥ 2024, < 2024.1.3`	`2021.1.42022.1.42024.1.3`
autocad electrical autodesk	`≥ 2021, < 2021.1.4≥ 2022, < 2022.1.4≥ 2023, < 2023.1.5≥ 2024, < 2024.1.3`	`2021.1.42022.1.42023.1.52024.1.3`
autocad lt autodesk	`≥ 2021, < 2021.1.4≥ 2022, < 2022.1.4≥ 2022, < 2022.4.1≥ 2023, < 2023.1.5≥ 2023, < 2023.3.1≥ 2024, < 2024.1.2≥ 2024, < 2024.1.3`	`2021.1.42022.1.42022.4.12023.1.52023.3.12024.1.22024.1.3`
autocad map 3d autodesk	`≥ 2021, < 2021.1.4≥ 2022, < 2022.1.4≥ 2023, < 2023.1.5≥ 2024, < 2024.1.3`	`2021.1.42022.1.42023.1.52024.1.3`
autocad mechanical autodesk	`≥ 2021, < 2021.1.4≥ 2022, < 2022.1.4≥ 2023, < 2023.1.5≥ 2024, < 2024.1.3`	`2021.1.42022.1.42023.1.52024.1.3`
autocad mep autodesk	`≥ 2021, < 2021.1.4≥ 2022, < 2022.1.4≥ 2023, < 2023.15≥ 2024, < 2024.1.3`	`2021.1.42022.1.42023.152024.1.3`
autocad plant 3d autodesk	`≥ 2021, < 2021.1.4≥ 2022, < 2022.1.4≥ 2023, < 2023.1.5≥ 2024, < 2024.1.3`	`2021.1.42022.1.42023.1.52024.1.3`
civil 3d autodesk	`≥ 2021, < 2021.1.4≥ 2022, < 2022.1.4≥ 2023, < 2023.1.5≥ 2024, < 2024.1.3`	`2021.1.42022.1.42023.1.52024.1.3`
dwg trueview autodesk	`≥ 2022, < 2022.1.4≥ 2023, < 2023.1.5≥ 2024, < 2024.1.3`	`2022.1.42023.1.52024.1.3`

概要

A maliciously crafted DWG file when parsed through Autodesk DWG TrueView can be used to cause a Stack-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.