PT-2021-24014 · Siemens · Solid Edge

Published 2021-12-14 · Updated 2023-02-21 · CVE-2021-44014

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: JT Open versions prior to 11.1.1.0 JT Utilities versions prior to 13.1.1.0 Solid Edge versions prior to 2023

Description: A use-after-free issue has been identified in the Jt1001.dll, which could be triggered by parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.

Recommendations: For JT Open versions prior to 11.1.1.0, update to version 11.1.1.0 or later. For JT Utilities versions prior to 13.1.1.0, update to version 13.1.1.0 or later. For Solid Edge versions prior to 2023, update to version 2023 or later.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2021-44014

ZDI-22-005

ZDI-23-090

Affected Products

Solid Edge

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-44014 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44014 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-005 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-090 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-936212.pdf · Vendor Advisory