Summary
Siemens has released updates for JT2Go, Solid Edge and Teamcenter Visualization to fix multiple file parsing vulnerabilities. If a user is tricked to open a malicious file (crafted as PDF, DXF or PAR) with any of the affected products, this could lead the application to crash or potentially lead to arbitrary code execution.
Siemens has released updates for some of the affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not yet available.
Vulnerabilities 5
-
High 7.8
Siemens Solid Edge, JT2Go, and Teamcenter Visualization Improper Restriction of Operations within the Bounds of a Memory Buffer
The Datalogics APDFL library used in affected products is vulnerable to memory corruption condition while parsing specially crafted PDF files. An attacker could leverage this vulnerability to execute code in the context of the current process.
-
Unscored —
An Out-of-Bounds Write vulnerability exists when reading a DXF or DWG file using Open Design Alliance Drawings SDK befo…
-
Unscored —
A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), …
-
Unscored —
A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), …
-
Unscored —
A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), …
Revision history
-
#4
Added fix for CVE-2021-43336, CVE-2021-44000, CVE-2021-44016 and CVE-2021-44018 in Teamcenter Visualization version line V13.1
-
#3
Added remediation for Teamcenter Visualization version line V13.2 and JT2Go
-
#2
Added remediation for Teamcenter Visualization version lines V12.4 and V13.3
-
#1
Publication Date
References
-
SSA-301589: Multiple File Parsing Vulnerabilities in Solid Edge, JT2Go and Teamcenter Visualization - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf
-
SSA-301589: Multiple File Parsing Vulnerabilities in Solid Edge, JT2Go and Teamcenter Visualization - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-301589.txt