PT-2024-7808 · Jt2Go · Jt2Go

Michael Heinzl · Published 2024-07-23 · Updated 2024-10-23 · CVE-2024-41902

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JT2Go versions prior to V2406.0003

Description A stack-based buffer overflow issue has been identified in the affected application. This issue could be triggered while parsing specially crafted PDF files, potentially allowing an attacker to execute code in the context of the current process. The exploitation of this issue may permit an attacker to execute arbitrary code.

Recommendations For versions prior to V2406.0003, update to version V2406.0003 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the affected application for parsing PDF files until a patch is applied. Restrict access to the application to minimize the risk of exploitation.

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

BDU:2024-09308

CVE-2024-41902

Affected Products

Jt2Go

References · 9

• https://cve.org/CVERecord?id=CVE-2024-41902 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-626178.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41902 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41902 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09308 · Security Note
• https://vuldb.com/?id.279592 · Note
• https://twitter.com/cracbot/status/1845343786303619215 · Twitter Post
• https://twitter.com/CVEnew/status/1843575701313659352 · Twitter Post
• https://vulners.com/nvd/NVD:CVE-2024-41902 · Note