# CVE-2022-39143 A vulnerability has been identified in Parasolid

**URL:** <https://discourse.shapr3d.com/t/cve-2022-39143-a-vulnerability-has-been-identified-in-parasolid/21409>\
**Category:** Modeling Questions\
**Created:** [September 14, 2022, 10:48pm UTC](https://discourse.shapr3d.com/t/cve-2022-39143-a-vulnerability-has-been-identified-in-parasolid/21409 "2022-09-14T22:48:50Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yepher](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.shapr3d.com/yepher/32/8902_2.png) [@Yepher](https://discourse.shapr3d.com/u/Yepher)\
**Post date:** [September 14, 2022, 10:48pm UTC](https://discourse.shapr3d.com/t/cve-2022-39143-a-vulnerability-has-been-identified-in-parasolid/21409/1 "2022-09-14T22:48:50Z")

</div>

Is Shapr3D exposed to this issue?

[pdf](https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf)

```auto
A vulnerability has been identified in 
Parasolid V33.1 (All versions < V33.1.262), 
Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), 
Parasolid V34.0 (All versions < V34.0.252), 
Parasolid V34.1 (All versions < V34.1.242), 
Parasolid V35.0 (All versions < V35.0.161), 
Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), 
Simcenter Femap V2022.1 (All versions < V2022.1.3), 
Simcenter Femap V2022.2 (All versions < V2022.2.2). 

The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17493)

```

[https://nvd.nist.gov/vuln/detail/CVE-2022-39143](https://nvd.nist.gov/vuln/detail/CVE-2022-39143)

Just wondering how concerned we should be when importing XT content.

---

<div class="post-metadata">

**Author:** ![Istvan](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.shapr3d.com/istvan/32/23668_2.png) [@Istvan](https://discourse.shapr3d.com/u/Istvan)\
**Post date:** [September 15, 2022, 9:55am UTC](https://discourse.shapr3d.com/t/cve-2022-39143-a-vulnerability-has-been-identified-in-parasolid/21409/2 "2022-09-15T09:55:31Z")

</div>

Hi @Yepher, yes, Shapr3D is impacted too, just like every other Parasolid based CAD. We are updating Parasolid and releasing an update immediately. While the vulnerability is serious, it’s very easy to avoid it: just avoid opening X\_T files from unreliable sources. But it’s still perfectly safe to open any file from your PDM or PLM system, or any file from a trusted source.

---

<div class="post-metadata">

**Author:** ![Yepher](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.shapr3d.com/yepher/32/8902_2.png) [@Yepher](https://discourse.shapr3d.com/u/Yepher)\
**Post date:** [September 15, 2022, 12:57pm UTC](https://discourse.shapr3d.com/t/cve-2022-39143-a-vulnerability-has-been-identified-in-parasolid/21409/3 "2022-09-15T12:57:55Z")

</div>

Thank you for the guidence.

I assume we should not load \*.shapr files shared on this forum or from places like [Printables.com](http://Printables.com) until the patch is complete, or are those safe?

---

<div class="post-metadata">

**Author:** ![Istvan](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.shapr3d.com/istvan/32/23668_2.png) [@Istvan](https://discourse.shapr3d.com/u/Istvan)\
**Post date:** [September 15, 2022, 1:41pm UTC](https://discourse.shapr3d.com/t/cve-2022-39143-a-vulnerability-has-been-identified-in-parasolid/21409/4 "2022-09-15T13:41:05Z")

</div>

Correct. Although realistically the actual risk is quite low.

---

<div class="post-metadata">

**Author:** ![Laci\_K](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.shapr3d.com/laci_k/32/8196_2.png) [@Laci\_K](https://discourse.shapr3d.com/u/Laci_K)\
**Post date:** [September 16, 2022, 2:59pm UTC](https://discourse.shapr3d.com/t/cve-2022-39143-a-vulnerability-has-been-identified-in-parasolid/21409/5 "2022-09-16T14:59:06Z")

</div>

Hi,

Fix is released, should be available in the coming hours depending on the stores. Version number is 5.214.

---

<div class="post-metadata">

**Author:** ![TheBum](https://avatars.discourse-cdn.com/v4/letter/t/eada6e/32.png) [@TheBum](https://discourse.shapr3d.com/u/TheBum)\
**Post date:** [September 16, 2022, 8:48pm UTC](https://discourse.shapr3d.com/t/cve-2022-39143-a-vulnerability-has-been-identified-in-parasolid/21409/6 "2022-09-16T20:48:07Z")

</div>

The update is available for download on the Mac at least. I just started Shapr a few minutes ago and I was prompted to upgrade to 5.214.0.

---

<div class="post-metadata">

**Author:** ![Pouln](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.shapr3d.com/pouln/32/14032_2.png) [@Pouln](https://discourse.shapr3d.com/u/Pouln)\
**Post date:** [September 18, 2022, 11:06am UTC](https://discourse.shapr3d.com/t/cve-2022-39143-a-vulnerability-has-been-identified-in-parasolid/21409/7 "2022-09-18T11:06:59Z")

</div>

Hmm, I don’t receive this update on my ipad. Still on 5.212 dven after closing and reopening the app.

---

<div class="post-metadata">

**Author:** ![Laci\_K](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.shapr3d.com/laci_k/32/8196_2.png) [@Laci\_K](https://discourse.shapr3d.com/u/Laci_K)\
**Post date:** [September 18, 2022, 11:07am UTC](https://discourse.shapr3d.com/t/cve-2022-39143-a-vulnerability-has-been-identified-in-parasolid/21409/8 "2022-09-18T11:07:43Z")

</div>

Check the App store, there should be an update button when you open the Shapr3D page.

---

<div class="post-metadata">

**Author:** ![Pouln](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.shapr3d.com/pouln/32/14032_2.png) [@Pouln](https://discourse.shapr3d.com/u/Pouln)\
**Post date:** [September 18, 2022, 11:48am UTC](https://discourse.shapr3d.com/t/cve-2022-39143-a-vulnerability-has-been-identified-in-parasolid/21409/9 "2022-09-18T11:48:38Z")

</div>

@Laci_Shapr3D Yep, found it. Not too obvious as it does not show that an update is there. Why doesn’t it update automatically, like other apps?

---

<div class="post-metadata">

**Author:** ![Laci\_K](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.shapr3d.com/laci_k/32/8196_2.png) [@Laci\_K](https://discourse.shapr3d.com/u/Laci_K)\
**Post date:** [September 18, 2022, 2:22pm UTC](https://discourse.shapr3d.com/t/cve-2022-39143-a-vulnerability-has-been-identified-in-parasolid/21409/10 "2022-09-18T14:22:51Z")

</div>

It depends on when the phased release reaches you. It’s takes a week to reach everyone, but you can manually update at any time.

---

<div class="post-metadata">

**Author:** ![Pouln](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.shapr3d.com/pouln/32/14032_2.png) [@Pouln](https://discourse.shapr3d.com/u/Pouln)\
**Post date:** [September 18, 2022, 4:23pm UTC](https://discourse.shapr3d.com/t/cve-2022-39143-a-vulnerability-has-been-identified-in-parasolid/21409/11 "2022-09-18T16:23:28Z")

</div>

@Laci_K ah ok. Thanks for the explanation.