Summary
COMOS uses Drawings SDK from Open Design Alliance that is affected by multiple vulnerabilities that could be triggered when the application reads files in DGN, DXF or DWG file formats. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to leak information or potentially perform remote code execution in the context of the current process.
Siemens has released an update for the COMOS and recommends to update to the latest version.
Vulnerabilities 15
-
Unscored —
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory allocation with excessive size vu…
-
Unscored —
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory corruption vulnerability exists w…
-
Unscored —
An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A Type Conversion issue exists when render…
-
Unscored —
An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A NULL pointer dereference exists when ren…
-
Unscored —
An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A Type Confusion issue exists when renderi…
-
Unscored —
An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A stack-based buffer overflow vulnerabilit…
-
Unscored —
An out-of-bounds write vulnerability exists in the file-reading procedure in Open Design Alliance Drawings SDK before 2…
-
Unscored —
An out-of-bounds write issue exists in the DXF file-recovering procedure in the Drawings SDK (All versions prior to 202…
-
Unscored —
Drawings SDK (All versions prior to 2022.4) are vulnerable to an out-of-bounds read due to parsing of DWG files resulti…
-
Unscored —
An out-of-bounds read issue exists in the DWG file-recovering procedure in the Drawings SDK (All versions prior to 2022…
-
Unscored —
A use-after-free issue exists in the DGN file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resu…
-
Unscored —
An improper check for unusual or exceptional conditions issue exists within the parsing DGN files from Drawings SDK (Ve…
-
Unscored —
An out-of-bounds write issue exists in the DWG file-reading procedure in the Drawings SDK (All versions prior to 2022.4…
-
Unscored —
An out-of-bounds read issue exists within the parsing of DXF files in the Drawings SDK (All versions prior to 2022.4) r…
-
Unscored —
An out-of-bounds write issue exists in the DGN file-reading procedure in the Drawings SDK (Version 2022.4 and prior) re…
Revision history
-
#1
Publication Date
References
-
SSA-155599: File Parsing Vulnerabilities in COMOS - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf
-
SSA-155599: File Parsing Vulnerabilities in COMOS - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-155599.txt