Over 100 Microsoft 365 app bugs prompt temporary SketchUp support removal

Microsoft has momentarily removed support for the SketchUp file format used for 3D model data storage after the patches it issued to address 117 security flaws impacting Microsoft 365 applications were circumvented, according to SecurityWeek. Zscaler ThreatLabz researchers discovered 20 security vulnerabilities from the numerous SketchUp APIs and wrapper functions invoked during the SKP file parsing process in Microsoft 365, including out-of-bounds write, heap buffer overflow, use-after-free, stack buffer overflow, integer overflow, and type confusion issues. Moreover, SKP file-embedded images enabled parsing through the FreeImage third-party library last updated five years ago. Ninety-seven FreeImage vulnerabilities reproducible in Microsoft 365 could be exploited through a specially crafted SketchUp file, said Zscaler ThreatLabz researchers. All of the remote code execution vulnerabilities, which were tracked as CVE-2023-28285, CVE-2023-29344, and CVE-2023-33146, have been remediated by Microsoft through patches issued between April and June but such fixes have been bypassed by Zscaler ThreatLabz.