SSA-277137: Multiple Vulnerabilities in SIDIS Prime Before V4.0.700
SIDIS Prime before V4.0.700 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, Boost C++ Libraries and several Microsoft components as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.
describes (14)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-9143US | — | — | ||
Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted
explicit values for the field polynomial can lead to out-of-bounds memory reads
or writes.
Impact su… | ||||
| CVE-2024-30105US | — | — | ||
.NET and Visual Studio Denial of Service Vulnerability | ||||
| CVE-2024-5535US | — | Exploit | ||
Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an
empty supported client protocols buffer may cause a crash or memory contents to
be sent to the peer.… | ||||
| CVE-2024-0727US | medium5.5 | — | ||
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL
to crash leading to a potential Denial of Service attack
Impact summary: Applications loading files… | ||||
| CVE-2024-0232US | medium5.5 | — | ||
A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass speci… | ||||
| CVE-2024-21319US | — | — | ||
Microsoft Identity Denial of service vulnerability | ||||
| CVE-2024-0056US | —OT elevated | — | ||
Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability | ||||
| CVE-2023-7104US | high7.3 | — | ||
A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of t… | ||||
| CVE-2023-5678US | medium5.3 | — | ||
Issue summary: Generating excessively long X9.42 DH keys or checking
excessively long X9.42 DH keys or parameters may be very slow.
Impact summary: Applications that use the funct… | ||||
| CVE-2023-5363US | high7.5 | — | ||
Issue summary: A bug has been identified in the processing of key and
initialisation vector (IV) lengths. This can lead to potential truncation
or overruns during the initialisati… | ||||
| CVE-2023-4807US | high7.8 | — | ||
Issue summary: The POLY1305 MAC (message authentication code) implementation
contains a bug that might corrupt the internal state of applications on the
Windows 64 platform when ru… | ||||
| CVE-2023-3446US | medium5.3 | — | ||
Issue summary: Checking excessively long DH keys or parameters may be very slow.
Impact summary: Applications that use the functions DH_check(), DH_check_ex()
or EVP_PKEY_param_ch… | ||||
| CVE-2023-2975US | medium5.3 | — | ||
Issue summary: The AES-SIV cipher implementation contains a bug that causes
it to ignore empty associated data entries which are unauthenticated as
a consequence.
Impact summary:… | ||||
| CVE-2022-21658US | medium6.3 | Exploit | ||
Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the… | ||||
references
External citations — patches, advisories, analysis.
remediations (14)
- FixedSIDIS Prime
Update to V4.0.700 or later version
- FixedSIDIS Prime
Update to V4.0.700 or later version
- FixedSIDIS Prime
Update to V4.0.700 or later version
- FixedSIDIS Prime
Update to V4.0.700 or later version
- FixedSIDIS Prime
Update to V4.0.700 or later version
- FixedSIDIS Prime
Update to V4.0.700 or later version
- FixedSIDIS Prime
Update to V4.0.700 or later version
- FixedSIDIS Prime
Update to V4.0.700 or later version
- FixedSIDIS Prime
Update to V4.0.700 or later version
- FixedSIDIS Prime
Update to V4.0.700 or later version
- FixedSIDIS Prime
Update to V4.0.700 or later version
- FixedSIDIS Prime
Update to V4.0.700 or later version
- FixedSIDIS Prime
Update to V4.0.700 or later version
- FixedSIDIS Prime
Update to V4.0.700 or later version
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan