ICSA-22-195-07

Siemens Datalogics File Parsing Vulnerability

Advisory ansehen veröffentlicht 2022-07-12

Siemens Teamcenter Visualization and JT2Go are affected by an out of bounds write vulnerability in APDFL library from Datalogics. If a user is tricked to open a malicious PDF file with the affected products, this could lead the application to crash or potentially lead to arbitrary code execution. Siemens has released updates for the affected products and recommends to update to the latest versions.

beschreibt (1)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2022-2069US	high7.8	0.46% (40th)	—	2022-10-20
The APDFL.dll in Siemens JT2Go prior to V13.3.0.5 and Siemens Teamcenter Visualization prior to V14.0.0.2 contains an out of bounds write past the fixed-length heap-based buffer wh…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

Behebungen (6)

MitigationJT2Go
Avoid to open untrusted files in JT2Go and Teamcenter Visualization
MitigationTeamcenter Visualization V13.3
Avoid to open untrusted files in JT2Go and Teamcenter Visualization
MitigationTeamcenter Visualization V14.0
Avoid to open untrusted files in JT2Go and Teamcenter Visualization
BehobenJT2Go
Update to V13.3.0.5 or later version
https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html
BehobenTeamcenter Visualization V13.3
Update to V13.3.0.5 or later version
https://support.sw.siemens.com/
BehobenTeamcenter Visualization V14.0
Update to V14.0.0.2 or later version
https://support.sw.siemens.com/

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan