Siemens Solid Edge, JT2Go, and Teamcenter Visualization Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2021-38405
7.8HIGH
Key Information:
- Vendor
- Siemens
- Vendor
- CVE Published:
- 21 November 2023
Summary
The Datalogics APDFL library has a vulnerability that can be exploited through specially crafted PDF files, leading to a memory corruption issue. Attackers can potentially execute arbitrary code within the context of the affected process, compromising system integrity and security. Organizations using the APDFL library should take immediate action to review their systems and apply the necessary patches.
Affected Version(s)
JT2Go 0 < 13.2.0.7
Teamcenter Visualization 12.4 < 12.4.0.13
Teamcenter Visualization 13.1 < 13.1.0.8
References
CVSS V3.1
Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Mat Powell of Trend Micro’s Zero Day Initiative reported these vulnerabilities to Siemens and CISA.