Siemens Solid Edge, JT2Go, and Teamcenter Visualization Improper Restriction of Operations within the Bounds of a Memory Buffer (Siemens JT2Go)
En bref
- Source
- NVD
- EPSS
- EPSS 1.27 % · centile 70 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- icscert
- Statut NVD
- Modified
Rechercher sur…
Description
The Datalogics APDFL library used in affected products is vulnerable to memory corruption condition while parsing specially crafted PDF files. An attacker could leverage this vulnerability to execute code in the context of the current process.
Faiblesses (CWE)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | icscert |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · ics-cert@hq.dhs.gov (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2021-24857
- GCVE · GCVE-0-2021-38405
Avis du CERT-FR
- CERTFR-2022-AVI-124 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*< 13.2.0.7cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*≥ 13.1.0 < 13.1.0.8cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*≥ 13.2.0 < 13.2.0.7cpe:2.3:a:siemens:teamcenter_visualization:13.3.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Siemens · JT2Go | affected 0 < 13.2.0.7 |
| Siemens · Teamcenter Visualization | affected 12.4 < 12.4.0.13 ; affected 13.1 < 13.1.0.8 ; affected 13.2 < 13.2.0.7 ; affected 13.3 < 13.3.0.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |