PT-2023-4725 · Siemens · Jt2Go+1
Published
2023-08-08
·
Updated
2023-08-14
·
CVE-2023-38683
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
JT2Go versions prior to 14.2.0.5
Teamcenter Visualization V13.2 versions prior to 13.2.0.14
Teamcenter Visualization V14.1 versions prior to 14.1.0.10
Teamcenter Visualization V14.2 versions prior to 14.2.0.5
Description
The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted TIFF file. This could allow an attacker to execute code in the context of the current process. The vulnerability is related to a buffer overflow issue, which can be exploited by inserting a specially formed TIFF file, potentially allowing an attacker to execute arbitrary code.
Recommendations
For JT2Go versions prior to 14.2.0.5, update to version 14.2.0.5 or later.
For Teamcenter Visualization V13.2 versions prior to 13.2.0.14, update to version 13.2.0.14 or later.
For Teamcenter Visualization V14.1 versions prior to 14.1.0.10, update to version 14.1.0.10 or later.
For Teamcenter Visualization V14.2 versions prior to 14.2.0.5, update to version 14.2.0.5 or later.
As a temporary workaround, consider restricting the use of TIFF files in the affected applications until a patch is available.
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jt2Go
Teamcenter Visualization