PT-2024-8758 · Siemens · Parasolid+2

Jin Huang · Published 2024-05-14 · Updated 2024-08-13 · CVE-2024-32635

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JT2Go versions prior to V2312.0005 Teamcenter Visualization V14.2 versions prior to V14.2.0.12 Teamcenter Visualization V14.3 versions prior to V14.3.0.10 Teamcenter Visualization V2312 versions prior to V2312.0005 Parasolid (affected versions not specified)

Description The issue is related to an out of bounds read in memory, which can occur when parsing specially crafted X T files. This could allow an attacker to execute arbitrary code in the context of the current process. The vulnerability can be exploited by using specially created X T files.

Recommendations For JT2Go versions prior to V2312.0005, update to version V2312.0005 or later. For Teamcenter Visualization V14.2 versions prior to V14.2.0.12, update to version V14.2.0.12 or later. For Teamcenter Visualization V14.3 versions prior to V14.3.0.10, update to version V14.3.0.10 or later. For Teamcenter Visualization V2312 versions prior to V2312.0005, update to version V2312.0005 or later. For Parasolid, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2024-10362

CVE-2024-32635

Affected Products

Jt2Go

Parasolid

Teamcenter Visualization

References · 6

• https://cert-portal.siemens.com/productcert/html/ssa-046364.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32635 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-856475.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32635 · Security Note
• https://bdu.fstec.ru/vul/2024-10362 · Security Note
• https://vuldb.com/?id.264178 · Note