CVE-2021-34306 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Siemens Jt2go

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787 — Out-of-bounds Write CWE-20 — Improper Input Validation3 documents3 sources

Severity

7.8HIGHNVD

EPSS

0.4%

top 38.96%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Siemens Jt2go Siemens Teamcenter Visualization

Timeline

PublishedJul 13

Latest updateMay 24

Description

A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in a memory corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13342)

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶NVDsiemens/teamcenter_visualization< 13.2.0

▶CVEListV5siemens/teamcenter_visualizationAll versions < V13.2

▶NVDsiemens/jt2go< 13.2.0

▶CVEListV5siemens/jt2goAll versions < V13.2

🔴Vulnerability Details

GHSA

GHSA-qjqq-jx62-v43m: A vulnerability has been identified in JT2Go (All versions < V13↗2022-05-24

▶

CVEList

CVE-2021-34306: A vulnerability has been identified in JT2Go (All versions < V13↗2021-07-13

▶