Siemens Solid Edge, JT2Go, and Teamcenter Visualization Improper Restriction of Operations within the Bounds of a Memory Buffer (Siemens JT2Go)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.27 % · percentile 70 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- icscert
- NVD status
- Modified
Description
The Datalogics APDFL library used in affected products is vulnerable to memory corruption condition while parsing specially crafted PDF files. An attacker could leverage this vulnerability to execute code in the context of the current process.
Weaknesses (CWE)
- CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-787 — Out-of-bounds Write
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | icscert |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · ics-cert@hq.dhs.gov (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-24857
- GCVE · GCVE-0-2021-38405
CERT-FR advisories
- CERTFR-2022-AVI-124 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*< 13.2.0.7cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*≥ 13.1.0 < 13.1.0.8cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*≥ 13.2.0 < 13.2.0.7cpe:2.3:a:siemens:teamcenter_visualization:13.3.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Siemens · JT2Go | affected 0 < 13.2.0.7 |
| Siemens · Teamcenter Visualization | affected 12.4 < 12.4.0.13 ; affected 13.1 < 13.1.0.8 ; affected 13.2 < 13.2.0.7 ; affected 13.3 < 13.3.0.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |