CVE-2021-34327 — Heap-based Buffer Overflow in Siemens

Vendor	Product	Version range	Fixed in
siemens	jt2go	< 13.2.0	13.2.0
siemens	jt2go	—	—
siemens	solid_edge	< se2021	se2021
siemens	solid_edge	—	—
siemens	solid_edge_se2021	—	—
siemens	teamcenter_visualization	< 13.2.0	13.2.0
siemens	teamcenter_visualization	—	—

GHSA

GHSA-v36w-44mj-4gpv: A vulnerability has been identified in JT2Go (All versions < V13

ghsa_unreviewed·2022-05-24

CVE-2021-34327 [HIGH] CWE-122 GHSA-v36w-44mj-4gpv: A vulnerability has been identified in JT2Go (All versions < V13 A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing ASM files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13423)

CISA ICS

Siemens Solid Edge

cisa_ics·2021-07-14·CVSS 7.8

[HIGH] Siemens Solid Edge ## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs. ICS Advisory ## Siemens Solid Edge Last RevisedJuly 14, 2021 Alert CodeICSA-21-194-08 ## 1. EXECUTIVE SUMMARY - CVSS v3 7.8 - ATTENTION: Low attack complexity - Vendor: Siemens - Equipment: Solid Edge - Vulnerabilities: Heap-based Buffer Overflow ## 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in an out-of-bounds write, a buffer overflow condition that may allow remote code execution. ## 3. TECHNICAL DETAILS ## 3.1 AFFECTED PRODUCTS The following versions of Siemens Solid Edge, a portfolio of software tools, are affected: - All versions prior to SE2

CISA ICS

Siemens JT2Go and Teamcenter Visualization

cisa_ics·2021-07-13·CVSS 5.5

[MEDIUM] Siemens JT2Go and Teamcenter Visualization ## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs. ICS Advisory ## Siemens JT2Go and Teamcenter Visualization Last RevisedJuly 13, 2021 Alert CodeICSA-21-194-15 ## 1. EXECUTIVE SUMMARY - CVSS v3 7.8 - ATTENTION: Low attack complexity - Vendor: Siemens - Equipment: JT2Go and Teamcenter Visualization - Vulnerabilities: Double Free, Infinite Loop, Out-of-bounds Write, Use After Free, Heap-based Buffer Overflow, Buffer Over-read, Out-of-bounds Read, Improper Restriction of Operations within the Bounds of a Memory Buffer ## 2. RISK EVALUATION Successful exploitation of these vulnerabilities could lead to application crash or potentially arbitr

CVE-2021-34327: A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions <…

Affected

CVSS provenance