CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2021-44002 – Siemens Solid Edge Viewer JT File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-44002
A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt1001.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15058, ZDI-CAN-19076, ZDI-CAN-19077) Se ha identificado una vulnerabilidad en JT2Go (Todas las versiones anteriores a V13.2.0.5), Teamcenter Visualization (Todas las versiones anteriores a V13.2.0.5). El archivo Jt1001.dll contiene una escritura fuera de límites más allá del final de una estructura asignada al analizar archivos JT especialmente diseñados. • https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-936212.pdf • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-44003
https://notcve.org/view.php?id=CVE-2021-44003
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to use of uninitialized memory while parsing user supplied TIFF files. This could allow an attacker to cause a denial-of-service condition. Se ha identificado una vulnerabilidad en JT2Go (Todas las versiones anteriores a V13.2.0.5), Teamcenter Visualization (Todas las versiones anteriores a V13.2.0.5). El archivo Tiff_Loader.dll es vulnerable al uso de memoria no inicializada mientras analiza los archivos TIFF suministrados por el usuario. • https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf • CWE-457: Use of Uninitialized Variable CWE-908: Use of Uninitialized Resource •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-44001 – Siemens JT2Go PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-44001
A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The DL180pdfl.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14974) Se ha identificado una vulnerabilidad en JT2Go (Todas las versiones anteriores a V13.2.0.5), Teamcenter Visualization (Todas las versiones anteriores a V13.2.0.5). El archivo DL180pdfl.dll contiene una escritura fuera de límites más allá del final de una estructura asignada mientras analiza archivos PDF especialmente diseñados. • https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf https://www.zerodayinitiative.com/advisories/ZDI-22-004 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-43336 – Siemens JT2Go DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-43336
An Out-of-Bounds Write vulnerability exists when reading a DXF or DWG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DXF and DWG files. Crafted data in a DXF or DWG file (an invalid number of properties) can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Se presenta una vulnerabilidad de escritura fuera de límites cuando es leído un archivo DXF usando Open Design Alliance Drawings SDK versiones anteriores a 2022.11. • https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf https://www.opendesign.com/security-advisories https://www.zerodayinitiative.com/advisories/ZDI-22-334 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-40356
https://notcve.org/view.php?id=CVE-2021-40356
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to view files on the application server filesystem. Se ha identificado una vulnerabilidad en Teamcenter versión V12.4 (Todas las versiones anteriores a V12.4.0.8), Teamcenter versión V13.0 (Todas las versiones anteriores a V13.0.0.7), Teamcenter versión V13.1 (Todas las versiones anteriores a V13.1.0.5), Teamcenter versión V13.2 (Todas las versiones anteriores a 13.2.0.2). La aplicación contiene una vulnerabilidad de tipo XML External Entity Injection (XXE). • https://cert-portal.siemens.com/productcert/pdf/ssa-987403.pdf • CWE-611: Improper Restriction of XML External Entity Reference •