PT-2022-6394 · Siemens · Jt2Go+1

Michael Heinz + 1 · Published 2022-12-13 · Updated 2023-01-23 · CVE-2022-3160

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions APDFL.dll (affected versions not specified)

Description The issue is related to an out-of-bounds write past a fixed-length heap-based buffer in the APDFL.dll while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process. The vulnerability is associated with the JT2Go 3D viewer tool and the Teamcenter Visualization product lifecycle management system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Stack Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-121

CWE-122

Related Identifiers

BDU:2023-01153

CVE-2022-3160

Affected Products

Jt2Go

Teamcenter Visualization

References · 9

• https://bdu.fstec.ru/vul/2023-01153 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3160 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3160 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-349-15 · Note
• https://cert-portal.siemens.com/productcert/html/ssa-360681.html · Note
• https://t.me/cvenotify/42677 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-22-349-15 · Note
• https://cert-portal.siemens.com/productcert/csaf/ssa-360681.json · Note
• https://vuldb.com/ru/?id.218261 · Note