PT-2022-6400 · Jt2Go+2 · Jt2Go+2

Michael Heinz + 1 · Published 2022-12-13 · Updated 2023-01-23 · CVE-2022-3161

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JT2Go (affected versions not specified) Teamcenter Visualization (affected versions not specified)

Description The issue is related to a memory corruption vulnerability in the APDFL.dll library, which occurs when parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.

Recommendations For JT2Go, consider disabling the use of the APDFL.dll library until a patch is available. For Teamcenter Visualization, restrict access to the APDFL.dll library to minimize the risk of exploitation. Avoid using the APDFL.dll library for parsing PDF files until the issue is resolved.

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2023-01159

CVE-2022-3161

Affected Products

Apdfl.Dll

Jt2Go

Teamcenter Visualization

References · 10

• https://bdu.fstec.ru/vul/2023-01159 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3161 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3161 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-360681.html · Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-349-15 · Note
• https://t.me/cibsecurity/56463 · Telegram Post
• https://vuldb.com/ru/?id.218271 · Note
• https://cert-portal.siemens.com/productcert/csaf/ssa-360681.json · Note
• https://cisa.gov/news-events/ics-advisories/icsa-22-349-15 · Note
• https://t.me/cvenotify/42669 · Telegram Post