PT-2021-24007 · Unknown+1 · Tiff Loader.Dll+2

Published 2021-12-14 · Updated 2021-12-15 · CVE-2021-44007

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: JT2Go versions prior to 13.2.0.5 Teamcenter Visualization versions prior to 13.2.0.5

Description: A vulnerability has been identified that could allow an attacker to cause a denial-of-service condition. The issue is related to an off-by-one error in the heap while parsing specially crafted TIFF files, which is contained in the Tiff Loader.dll.

Recommendations: For JT2Go versions prior to 13.2.0.5, update to version 13.2.0.5 or later to resolve the issue. For Teamcenter Visualization versions prior to 13.2.0.5, update to version 13.2.0.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Tiff Loader.dll until a patch is available.

Fix

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2021-44007

Affected Products

Jt2Go

Teamcenter Visualization

Tiff Loader.Dll

References · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44007 · Security Note
• https://t.me/cibsecurity/33914 · Telegram Post