Description
A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (All versions < SE2022MP1), Teamcenter Visualization V13.1 (All versions < V13.1.0.9), Teamcenter Visualization V13.2 (All versions < V13.2.0.7), Teamcenter Visualization V13.3 (All versions < V13.3.0.1). The plmxmlAdapterSE70.dll contains an out of bounds write past the fixed-length heap-based buffer while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15053)
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | JT2Go | All versions < V13.2.0.7 | — |
| Siemens | Solid Edge SE2021 | All versions < SE2021MP9 | — |
| Siemens | Solid Edge SE2022 | All versions < SE2022MP1 | — |
| Siemens | Teamcenter Visualization V13.1 | All versions < V13.1.0.9 | — |
| Siemens | Teamcenter Visualization V13.2 | All versions < V13.2.0.7 | — |
| Siemens | Teamcenter Visualization V13.3 | All versions < V13.3.0.1 | — |
Advisories 2
- ICSA-22-041-07 Siemens Solid Edge, JT2Go, and Teamcenter Visualization CISA ICS & IT advisories · Jun 14, 2022
- SSA-301589 SSA-301589: Multiple File Parsing Vulnerabilities in Solid Edge, JT2Go and Teamcenter Visualization Siemens ProductCERT · Jun 14, 2022