Google Sketchup vulnerabilities

7 CVEs affecting Google Sketchup, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-2536, published 2016-02-22.

More from Google.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2013-3662, published 2014-07-01. High severity, CVSS 9.3. EPSS: 31.9% chance of exploitation in the next 30 days. Timbre SketchUp (formerly Google SketchUp) before 8 Maintenance 2 allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers a…
• CVE-2013-3663, published 2014-06-13. High severity, CVSS 9.3. EPSS: 31.9% chance of exploitation in the next 30 days. Heap-based buffer overflow in paintlib, as used in Trimble SketchUp (formerly Google SketchUp) before 8 Maintenance 3, allows remote attackers to execute arbitrary code via a crafted RLE8 compressed…
• CVE-2013-3664, published 2014-07-01. High severity, CVSS 9.3. EPSS: 29.8% chance of exploitation in the next 30 days. Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers an…
• CVE-2013-7388, published 2014-07-01. High severity, CVSS 9.3. EPSS: 13.2% chance of exploitation in the next 30 days. Heap-based buffer overflow in paintlib, as used in Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689), allows remote attackers to execute arbitrary code via a crafted RLE4-compressed…
• CVE-2012-4894, published 2012-10-05. High severity, CVSS 9.3. EPSS: 5.3% chance of exploitation in the next 30 days. Google SketchUp before 8.0.14346 (aka 8 Maintenance 3) allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted SKP file.
• CVE-2016-2536, published 2016-02-22. High severity, CVSS 8.8. EPSS: 3.1% chance of exploitation in the next 30 days. Multiple use-after-free vulnerabilities in SAP 3D Visual Enterprise Viewer allow remote attackers to execute arbitrary code via a crafted SketchUp document. NOTE: the primary affected product may be…
• CVE-2011-2478, published 2012-04-17. High severity, CVSS 9.3. EPSS: 2.1% chance of exploitation in the next 30 days. Google SketchUp before 8 does not properly handle edge geometry in SketchUp (aka .SKP) files, which allows remote attackers to execute arbitrary code via a crafted file.