CVE-2025-59489 (CNNVD-202510-474)
中文标题:
Unity Runtime 参数注入漏洞
英文标题:
Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that...
漏洞描述
中文描述:
Unity Runtime是美国Unity公司的一款负责执行逻辑、渲染、物理与交互的底层系统。 Unity Runtime 2025-10-02之前版本存在参数注入漏洞，该漏洞源于参数注入，可能导致从意外位置加载库代码，从而执行任意代码和泄露机密信息。
英文描述:
Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Unity3D | Unity Editor | - | < 6000.3.0b4 | - |
cpe:2.3:a:unity3d:unity_editor:*:*:*:*:*:*:*:*
|
| unity | editor | * | - | - |
cpe:2.3:a:unity:editor:*:*:*:*:-:*:*:*
|
| unity | editor | 2017.1.2p4\+ | - | - |
cpe:2.3:a:unity:editor:2017.1.2p4\+:*:*:*:-:*:*:*
|
| unity | editor | 2017.2.0p4\+ | - | - |
cpe:2.3:a:unity:editor:2017.2.0p4\+:*:*:*:-:*:*:*
|
| unity | editor | 2017.3.0b9\+ | - | - |
cpe:2.3:a:unity:editor:2017.3.0b9\+:*:*:*:-:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
HIGHCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-59489 |
2025-11-11 15:23:31 | 2025-11-11 07:40:46 |
| NVD | nvd_CVE-2025-59489 |
2025-11-11 15:01:04 | 2025-11-11 07:48:33 |
| CNNVD | cnnvd_CNNVD-202510-474 |
2025-11-11 15:12:27 | 2025-11-11 08:00:20 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-202510-474
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 21 -> 5
- data_sources: ['cve'] -> ['cve', 'nvd']