Action not permitted
Modal body text goes here.
cve-2021-34326
Vulnerability from cvelistv5
▼ | URL | Tags | |
---|---|---|---|
productcert@siemens.com | https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf | Vendor Advisory | |
productcert@siemens.com | https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf | Vendor Advisory | |
productcert@siemens.com | https://www.zerodayinitiative.com/advisories/ZDI-21-864/ | Third Party Advisory, VDB Entry |
▼ | Vendor | Product |
---|---|---|
Siemens | JT2Go | |
Siemens | Solid Edge SE2021 | |
Siemens | Teamcenter Visualization |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T00:05:52.502Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "JT2Go", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c V13.2" } ] }, { "product": "Solid Edge SE2021", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All Versions \u003c SE2021MP5" } ] }, { "product": "Teamcenter Visualization", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c V13.2" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2021-07-19T10:06:59", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf" }, { "tags": [ "x_refsource_MISC" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "productcert@siemens.com", "ID": "CVE-2021-34326", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "JT2Go", "version": { "version_data": [ { "version_value": "All versions \u003c V13.2" } ] } }, { "product_name": "Solid Edge SE2021", "version": { "version_data": [ { "version_value": "All Versions \u003c SE2021MP5" } ] } }, { "product_name": "Teamcenter Visualization", "version": { "version_data": [ { "version_value": "All versions \u003c V13.2" } ] } } ] }, "vendor_name": "Siemens" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)" } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-122: Heap-based Buffer Overflow" } ] } ] }, "references": { "reference_data": [ { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf", "refsource": "MISC", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf" }, { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf", "refsource": "MISC", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf" }, { "name": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/" } ] } } } }, "cveMetadata": { "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2021-34326", "datePublished": "2021-07-13T11:03:42", "dateReserved": "2021-06-08T00:00:00", "dateUpdated": "2024-08-04T00:05:52.502Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2021-34326\",\"sourceIdentifier\":\"productcert@siemens.com\",\"published\":\"2021-07-13T11:15:12.927\",\"lastModified\":\"2022-10-27T12:23:58.637\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)\"},{\"lang\":\"es\",\"value\":\"Se ha identificado una vulnerabilidad en JT2Go (Todas las versiones anteriores a V13.2), Solid Edge SE2021 (Todas las versiones anteriores a SE2021MP5), Teamcenter Visualization (Todas las versiones anteriores a V13.2). La biblioteca plmxmlAdapterSE70.dll de las aplicaciones afectadas no comprueba apropiadamente los datos suministrados por el usuario cuando se analizan los archivos PAR. Esto podr\u00eda resultar en una escritura fuera de l\u00edmites m\u00e1s all\u00e1 del b\u00fafer de fixed-length en la regi\u00f3n heap de la memoria. Un atacante podr\u00eda aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del proceso actual. (ZDI-CAN-13422)\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":6.8},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"productcert@siemens.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-122\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"13.2.0\",\"matchCriteriaId\":\"CAFFF33E-9758-4C92-B2BF-2CF0E2EA6217\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"se2021\",\"matchCriteriaId\":\"576A303A-66CA-4694-AA54-9EB0137C24F1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"39D237BD-EE55-4B40-ABC3-194C4BF7C6CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:*\",\"matchCriteriaId\":\"49F5649A-349C-42C6-AFFF-CEE1ABC14E67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack2:*:*:*:*:*:*\",\"matchCriteriaId\":\"756343AA-DB57-40F7-94FA-84BFCDEB6159\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack3:*:*:*:*:*:*\",\"matchCriteriaId\":\"36B0DD28-653E-4069-AB5A-38F8EFEB36CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack4:*:*:*:*:*:*\",\"matchCriteriaId\":\"82090774-D894-41C8-82F1-A48A8707E9BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"13.2.0\",\"matchCriteriaId\":\"6C391214-6E11-4196-BF69-5327069864D8\"}]}]}],\"references\":[{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.zerodayinitiative.com/advisories/ZDI-21-864/\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]}]}}" } }
icsa-21-194-15
Vulnerability from csaf_cisa
Notes
{ "document": { "acknowledgments": [ { "names": [ "Brian Gorenc", "Mat Powell" ], "organization": "Trend Micro Zero Day Initiative", "summary": "reporting these vulnerabilities to CISA" }, { "names": [ "garmin", "xina1i" ], "organization": "SecZone", "summary": "reporting these vulnerabilities to CISA" }, { "names": [ "Tran Van Khang - khangkito" ], "organization": "VinCSS", "summary": "reporting these vulnerabilities to CISA" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "general", "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov", "title": "CISA Disclaimer" }, { "category": "summary", "text": "Brian Gorenc and Mat Powell of Trend Micro Zero Day Initiative; garmin and xina1i at SecZone; and Tran Van Khang - khangkito (VinCSS) working with Trend Micro Zero Day Initiative reported these vulnerabilities to CISA.", "title": "Summary" }, { "category": "other", "text": "No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.", "title": "Exploitability" } ], "publisher": { "category": "coordinator", "contact_details": "CISAservicedesk@cisa.dhs.gov", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "ICS Advisory ICSA-21-194-15 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-194-15.json" }, { "category": "self", "summary": "ICS Advisory ICSA-21-194-15 Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-194-15" } ], "title": "ICSA-21-194-15_Siemens JT2Go and Teamcenter Visualization", "tracking": { "current_release_date": "2021-07-13T00:00:00.000000Z", "generator": { "engine": { "name": "CISA USCert CSAF Generator", "version": "1" } }, "id": "ICSA-21-194-15", "initial_release_date": "2021-07-13T00:00:00.000000Z", "revision_history": [ { "date": "2021-07-13T00:00:00.000000Z", "legacy_version": "Initial", "number": "1", "summary": "ICSA-21-194-15 Siemens JT2Go and Teamcenter Visualization" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c 13.2", "product": { "name": "Teamcenter Visualization: All versions prior to v13.2", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "Teamcenter Visualization" }, { "branches": [ { "category": "product_version_range", "name": "\u003c 13.2", "product": { "name": "JT2Go: All versions prior to v13.2", "product_id": "CSAFPID-0002" } } ], "category": "product_name", "name": "JT2Go" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-34333", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "summary", "text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. A malformed input file could result in a double free of an allocated buffer that leads to a crash. An attacker could leverage this vulnerability to cause denial-of-service condition.CVE-2021-34333 has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34333" }, { "cve": "CVE-2021-34332", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)" }, "notes": [ { "category": "summary", "text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. A malformed input file could result in an infinite loop condition that leads to a denial-of-service condition. An attacker could leverage this vulnerability to consume excessive resources.CVE-2021-34332 has been assigned to this vulnerability. A CVSS v3 base score of 5.5 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34332" }, { "cve": "CVE-2021-34331", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data when parsing JT files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34331 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34331" }, { "cve": "CVE-2021-34330", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "summary", "text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing JT files. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34330 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34330" }, { "cve": "CVE-2021-34329", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "summary", "text": "The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code. The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34329 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34329" }, { "cve": "CVE-2021-34328", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "summary", "text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34328 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34328" }, { "cve": "CVE-2021-34327", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "summary", "text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing ASM files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34327 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34327" }, { "cve": "CVE-2021-34326", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "summary", "text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. CVE-2021-34326 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34326" }, { "cve": "CVE-2021-34325", "cwe": { "id": "CWE-126", "name": "Buffer Over-read" }, "notes": [ { "category": "summary", "text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data when parsing JT files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. CVE-2021-34325 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34325" }, { "cve": "CVE-2021-34324", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "summary", "text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. CVE-2021-34324 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34324" }, { "cve": "CVE-2021-34323", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data when parsing JT files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. CVE-2021-34323 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34323" }, { "cve": "CVE-2021-34322", "cwe": { "id": "CWE-126", "name": "Buffer Over-read" }, "notes": [ { "category": "summary", "text": "The JPEG2K_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing J2K files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. CVE-2021-34322 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34322" }, { "cve": "CVE-2021-34321", "cwe": { "id": "CWE-126", "name": "Buffer Over-read" }, "notes": [ { "category": "summary", "text": "The VisDraw.dll library in affected applications lacks proper validation of user-supplied data when parsing J2K files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34321 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34321" }, { "cve": "CVE-2021-34320", "cwe": { "id": "CWE-126", "name": "Buffer Over-read" }, "notes": [ { "category": "summary", "text": "The Jt981.dll library in affected applications lacks proper validation of user-supplied data when parsing JT files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34320 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34320" }, { "cve": "CVE-2021-34319", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "The BMP_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing SGI files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34319 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34319 " }, { "cve": "CVE-2021-34318", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "The BMP_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing PCT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34318 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34318" }, { "cve": "CVE-2021-34317", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "summary", "text": "The BMP_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing PCX files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34317 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34317" }, { "cve": "CVE-2021-34316", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "The DL180CoolType.dll library in affected applications lacks proper validation of user-supplied data when parsing PDF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34316 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34316" }, { "cve": "CVE-2021-34315", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "summary", "text": "The BMP_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing SGI files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34315 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34315" }, { "cve": "CVE-2021-34314", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "The BMP_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing SGI files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34314 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34314 " }, { "cve": "CVE-2021-34313", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "summary", "text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34313 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34313" }, { "cve": "CVE-2021-34312", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "summary", "text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34312 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34312" }, { "cve": "CVE-2021-34311", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "The Mono_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing J2K files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34311 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34311" }, { "cve": "CVE-2021-34310", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34310 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34310" }, { "cve": "CVE-2021-34309", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34309 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34309" }, { "cve": "CVE-2021-34308", "cwe": { "id": "CWE-126", "name": "Buffer Over-read" }, "notes": [ { "category": "summary", "text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34308 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34308" }, { "cve": "CVE-2021-34307", "cwe": { "id": "CWE-126", "name": "Buffer Over-read" }, "notes": [ { "category": "summary", "text": "The Tiff_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34307 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34307" }, { "cve": "CVE-2021-34306", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "summary", "text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in a memory corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34306 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34306" }, { "cve": "CVE-2021-34305", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34305 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34305" }, { "cve": "CVE-2021-34304", "cwe": { "id": "CWE-126", "name": "Buffer Over-read" }, "notes": [ { "category": "summary", "text": "The Tiff_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34304 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34304" }, { "cve": "CVE-2021-34303", "cwe": { "id": "CWE-126", "name": "Buffer Over-read" }, "notes": [ { "category": "summary", "text": "The Tiff_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34303 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34303" }, { "cve": "CVE-2021-34302", "cwe": { "id": "CWE-126", "name": "Buffer Over-read" }, "notes": [ { "category": "summary", "text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34302 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34302" }, { "cve": "CVE-2021-34301", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "summary", "text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing BMP files. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34301 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34301" }, { "cve": "CVE-2021-34300", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds write past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34300 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34300" }, { "cve": "CVE-2021-34299", "cwe": { "id": "CWE-126", "name": "Buffer Over-read" }, "notes": [ { "category": "summary", "text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process.CVE-2021-34299 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34299" }, { "cve": "CVE-2021-34298", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "summary", "text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing BMP files. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34298 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34298" }, { "cve": "CVE-2021-34297", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34297 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34297" }, { "cve": "CVE-2021-34296", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "summary", "text": "The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34296 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34296" }, { "cve": "CVE-2021-34295", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34295 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34295" }, { "cve": "CVE-2021-34294", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "summary", "text": "The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34294 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34294" }, { "cve": "CVE-2021-34293", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34293 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34293" }, { "cve": "CVE-2021-34292", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "summary", "text": "The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out-of-bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34292 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34292" }, { "cve": "CVE-2021-34291", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.CVE-2021-34291 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002" ] }, "references": [ { "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals.", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" }, { "category": "mitigation", "details": "JT2Go: Update to v13.2", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html" }, { "category": "mitigation", "details": "Teamcenter Visualization: Update to v13.2 (login required)", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002" ], "url": "https://support.sw.siemens.com/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-0001", "CSAFPID-0002" ] } ], "title": "CVE-2021-34291" } ] }
icsa-21-194-08
Vulnerability from csaf_cisa
Notes
{ "document": { "acknowledgments": [ { "names": [ "Mat Powell" ], "organization": "Trend Micro \u0027s Zero Day Initiative", "summary": "reporting these vulnerabilities to CISA" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "lang": "en-US", "notes": [ { "category": "general", "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov", "title": "CISA Disclaimer" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "summary", "text": "Successful exploitation of these vulnerabilities could result in an out-of-bounds write, a buffer overflow condition that may allow remote code execution.", "title": "Risk evaluation" }, { "category": "other", "text": "Critical Manufacturing", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Germany", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "other", "text": "No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.", "title": "Exploitability" } ], "publisher": { "category": "coordinator", "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "external", "summary": "SSA-173615: Multiple PAR and ASM File Parsing Vulnerabilities in Solid Edge - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-173615.json" }, { "category": "self", "summary": "ICS Advisory ICSA-21-194-08 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-194-08.json" }, { "category": "self", "summary": "ICS Advisory ICSA-21-194-08 Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-194-08" }, { "category": "external", "summary": "Recommended Practices", "url": "https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B" }, { "category": "external", "summary": "SSA-173615: Multiple PAR and ASM File Parsing Vulnerabilities in Solid Edge - PDF Version", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf" }, { "category": "external", "summary": "SSA-173615: Multiple PAR and ASM File Parsing Vulnerabilities in Solid Edge - TXT Version", "url": "https://cert-portal.siemens.com/productcert/txt/ssa-173615.txt" } ], "title": "Siemens Solid Edge", "tracking": { "current_release_date": "2021-07-13T00:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-21-194-08", "initial_release_date": "2021-07-13T00:00:00.000000Z", "revision_history": [ { "date": "2021-07-13T00:00:00.000000Z", "legacy_version": "Initial", "number": "1", "summary": "ICSA-21-194-08 Siemens Solid Edge" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "All Versions \u003c SE2021MP5", "product": { "name": "Solid Edge SE2021", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "Solid Edge SE2021" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-34326", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "summary", "text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "summary": "CVE-2021-34326 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-34326.json" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34326" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to SE2021MP5 or later version", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "Avoid to open untrusted files from unknown sources in Solid Edge", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2021-34326" }, { "cve": "CVE-2021-34327", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "summary", "text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing ASM files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13423)", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "summary": "CVE-2021-34327 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-34327.json" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34327" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to SE2021MP5 or later version", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "Avoid to open untrusted files from unknown sources in Solid Edge", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2021-34327" }, { "cve": "CVE-2021-34328", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "summary", "text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13424)", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "summary": "CVE-2021-34328 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-34328.json" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34328" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to SE2021MP5 or later version", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "Avoid to open untrusted files from unknown sources in Solid Edge", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2021-34328" }, { "cve": "CVE-2021-34329", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "summary", "text": "The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13427)", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "summary": "CVE-2021-34329 Mitre 5.0 json", "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-34329.json" }, { "category": "external", "summary": "web.nvd.nist.gov", "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34329" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "remediations": [ { "category": "vendor_fix", "details": "Update to SE2021MP5 or later version", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "Avoid to open untrusted files from unknown sources in Solid Edge", "product_ids": [ "CSAFPID-0001" ] }, { "category": "mitigation", "details": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2021-34329" } ] }
ghsa-cm7m-hh39-78r7
Vulnerability from github
A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)
{ "affected": [], "aliases": [ "CVE-2021-34326" ], "database_specific": { "cwe_ids": [ "CWE-122", "CWE-20", "CWE-787" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2021-07-13T11:15:00Z", "severity": "HIGH" }, "details": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)", "id": "GHSA-cm7m-hh39-78r7", "modified": "2022-10-27T19:00:41Z", "published": "2022-05-24T19:07:38Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34326" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf" }, { "type": "WEB", "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-864" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ] }
gsd-2021-34326
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2021-34326", "description": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)", "id": "GSD-2021-34326" }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2021-34326" ], "details": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)", "id": "GSD-2021-34326", "modified": "2023-12-13T01:23:14.101134Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "productcert@siemens.com", "ID": "CVE-2021-34326", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "JT2Go", "version": { "version_data": [ { "version_value": "All versions \u003c V13.2" } ] } }, { "product_name": "Solid Edge SE2021", "version": { "version_data": [ { "version_value": "All Versions \u003c SE2021MP5" } ] } }, { "product_name": "Teamcenter Visualization", "version": { "version_data": [ { "version_value": "All versions \u003c V13.2" } ] } } ] }, "vendor_name": "Siemens" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)" } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-122: Heap-based Buffer Overflow" } ] } ] }, "references": { "reference_data": [ { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf", "refsource": "MISC", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf" }, { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf", "refsource": "MISC", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf" }, { "name": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "se2021", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "13.2.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "13.2.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack3:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack4:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "productcert@siemens.com", "ID": "CVE-2021-34326" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422)" } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-787" } ] } ] }, "references": { "reference_data": [ { "name": "N/A", "refsource": "CONFIRM", "tags": [ "Vendor Advisory" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf" }, { "name": "N/A", "refsource": "CONFIRM", "tags": [ "Vendor Advisory" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf" }, { "name": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/", "refsource": "MISC", "tags": [ "Third Party Advisory", "VDB Entry" ], "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-864/" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 1.8, "impactScore": 5.9 } }, "lastModifiedDate": "2022-10-27T12:23Z", "publishedDate": "2021-07-13T11:15Z" } } }
var-202107-1421
Vulnerability from variot
A vulnerability has been identified in JT2Go (All versions < V13.2), Solid Edge SE2021 (All Versions < SE2021MP5), Teamcenter Visualization (All versions < V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422). Zero Day Initiative To this vulnerability ZDI-CAN-13422 Was numbering.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of PAR files. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202107-1421", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "solid edge", "scope": "eq", "trust": 1.0, "vendor": "siemens", "version": "se2021" }, { "model": "jt2go", "scope": "lt", "trust": 1.0, "vendor": "siemens", "version": "13.2.0" }, { "model": "teamcenter visualization", "scope": "lt", "trust": 1.0, "vendor": "siemens", "version": "13.2.0" }, { "model": "solid edge", "scope": "lt", "trust": 1.0, "vendor": "siemens", "version": "se2021" }, { "model": "solid edge", "scope": null, "trust": 0.8, "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9", "version": null }, { "model": "teamcenter visualization", "scope": "eq", "trust": 0.8, "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9", "version": "13.2" }, { "model": "jt2go", "scope": null, "trust": 0.8, "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9", "version": null }, { "model": "jt2go", "scope": null, "trust": 0.7, "vendor": "siemens", "version": null } ], "sources": [ { "db": "ZDI", "id": "ZDI-21-864" }, { "db": "JVNDB", "id": "JVNDB-2021-009279" }, { "db": "NVD", "id": "CVE-2021-34326" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:siemens:solid_edge:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "se2021", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "13.2.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "13.2.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack3:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:siemens:solid_edge:se2021:maintenance_pack4:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2021-34326" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Mat Powell of Trend Micro Zero Day Initiative", "sources": [ { "db": "ZDI", "id": "ZDI-21-864" }, { "db": "CNNVD", "id": "CNNVD-202107-923" } ], "trust": 1.3 }, "cve": "CVE-2021-34326", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "NVD", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "impactScore": 6.4, "integrityImpact": "PARTIAL", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "trust": 1.0, "userInteractionRequired": true, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Medium", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "Partial", "baseScore": 6.8, "confidentialityImpact": "Partial", "exploitabilityScore": null, "id": "CVE-2021-34326", "impactScore": null, "integrityImpact": "Partial", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.9, "userInteractionRequired": null, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "LOCAL", "author": "NVD", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 1.8, "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Local", "author": "NVD", "availabilityImpact": "High", "baseScore": 7.8, "baseSeverity": "High", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "CVE-2021-34326", "impactScore": null, "integrityImpact": "High", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "Required", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, { "attackComplexity": "LOW", "attackVector": "LOCAL", "author": "ZDI", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 1.8, "id": "CVE-2021-34326", "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 0.7, "userInteraction": "REQUIRED", "vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2021-34326", "trust": 1.8, "value": "HIGH" }, { "author": "ZDI", "id": "CVE-2021-34326", "trust": 0.7, "value": "HIGH" }, { "author": "CNNVD", "id": "CNNVD-202107-923", "trust": 0.6, "value": "HIGH" }, { "author": "CNNVD", "id": "CNNVD-202104-975", "trust": 0.6, "value": "MEDIUM" }, { "author": "VULMON", "id": "CVE-2021-34326", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "ZDI", "id": "ZDI-21-864" }, { "db": "VULMON", "id": "CVE-2021-34326" }, { "db": "JVNDB", "id": "JVNDB-2021-009279" }, { "db": "CNNVD", "id": "CNNVD-202107-923" }, { "db": "CNNVD", "id": "CNNVD-202104-975" }, { "db": "NVD", "id": "CVE-2021-34326" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "A vulnerability has been identified in JT2Go (All versions \u003c V13.2), Solid Edge SE2021 (All Versions \u003c SE2021MP5), Teamcenter Visualization (All versions \u003c V13.2). The plmxmlAdapterSE70.dll library in affected applications lacks proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13422). Zero Day Initiative To this vulnerability ZDI-CAN-13422 Was numbering.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of PAR files. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements", "sources": [ { "db": "NVD", "id": "CVE-2021-34326" }, { "db": "JVNDB", "id": "JVNDB-2021-009279" }, { "db": "ZDI", "id": "ZDI-21-864" }, { "db": "CNNVD", "id": "CNNVD-202104-975" }, { "db": "VULMON", "id": "CVE-2021-34326" } ], "trust": 2.88 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2021-34326", "trust": 4.0 }, { "db": "ZDI", "id": "ZDI-21-864", "trust": 3.2 }, { "db": "SIEMENS", "id": "SSA-173615", "trust": 1.7 }, { "db": "SIEMENS", "id": "SSA-483182", "trust": 1.7 }, { "db": "JVNDB", "id": "JVNDB-2021-009279", "trust": 0.8 }, { "db": "ZDI_CAN", "id": "ZDI-CAN-13422", "trust": 0.7 }, { "db": "AUSCERT", "id": "ESB-2021.2403", "trust": 0.6 }, { "db": "CS-HELP", "id": "SB2021071508", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-202107-923", "trust": 0.6 }, { "db": "CS-HELP", "id": "SB2021041363", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-202104-975", "trust": 0.6 }, { "db": "VULMON", "id": "CVE-2021-34326", "trust": 0.1 } ], "sources": [ { "db": "ZDI", "id": "ZDI-21-864" }, { "db": "VULMON", "id": "CVE-2021-34326" }, { "db": "JVNDB", "id": "JVNDB-2021-009279" }, { "db": "CNNVD", "id": "CNNVD-202107-923" }, { "db": "CNNVD", "id": "CNNVD-202104-975" }, { "db": "NVD", "id": "CVE-2021-34326" } ] }, "id": "VAR-202107-1421", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VARIoT devices database", "id": null } ], "trust": 0.15799868 }, "last_update_date": "2024-04-26T10:58:15.919000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "SSA-173615 Siemens\u00a0Security\u00a0Advisory", "trust": 0.8, "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf" }, { "title": "", "trust": 0.7, "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-194-15https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf" }, { "title": "Siemens Jt2go and Siemens Teamcenter Visualization Security vulnerabilities", "trust": 0.6, "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=156616" }, { "title": "Siemens Security Advisories: Siemens Security Advisory", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=e172da356a059f9e1b4ef7215ce64ef1" }, { "title": "Siemens Security Advisories: Siemens Security Advisory", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=aa85c53444a3e0726ddb55922c9060c8" } ], "sources": [ { "db": "ZDI", "id": "ZDI-21-864" }, { "db": "VULMON", "id": "CVE-2021-34326" }, { "db": "JVNDB", "id": "JVNDB-2021-009279" }, { "db": "CNNVD", "id": "CNNVD-202107-923" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-787", "trust": 1.0 }, { "problemtype": "Out-of-bounds writing (CWE-787) [NVD evaluation ]", "trust": 0.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2021-009279" }, { "db": "NVD", "id": "CVE-2021-34326" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 3.1, "url": "https://www.zerodayinitiative.com/advisories/zdi-21-864/" }, { "trust": 1.7, "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf" }, { "trust": 1.7, "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-173615.pdf" }, { "trust": 1.4, "url": "https://nvd.nist.gov/vuln/detail/cve-2021-34326" }, { "trust": 0.7, "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-194-15https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf" }, { "trust": 0.6, "url": "https://www.cybersecurity-help.cz/vdb/sb2021071508" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2021.2403" }, { "trust": 0.6, "url": "https://www.cybersecurity-help.cz/vdb/sb2021041363" }, { "trust": 0.1, "url": "https://cwe.mitre.org/data/definitions/20.html" }, { "trust": 0.1, "url": "https://nvd.nist.gov" } ], "sources": [ { "db": "ZDI", "id": "ZDI-21-864" }, { "db": "VULMON", "id": "CVE-2021-34326" }, { "db": "JVNDB", "id": "JVNDB-2021-009279" }, { "db": "CNNVD", "id": "CNNVD-202107-923" }, { "db": "CNNVD", "id": "CNNVD-202104-975" }, { "db": "NVD", "id": "CVE-2021-34326" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "ZDI", "id": "ZDI-21-864" }, { "db": "VULMON", "id": "CVE-2021-34326" }, { "db": "JVNDB", "id": "JVNDB-2021-009279" }, { "db": "CNNVD", "id": "CNNVD-202107-923" }, { "db": "CNNVD", "id": "CNNVD-202104-975" }, { "db": "NVD", "id": "CVE-2021-34326" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2021-07-19T00:00:00", "db": "ZDI", "id": "ZDI-21-864" }, { "date": "2021-07-13T00:00:00", "db": "VULMON", "id": "CVE-2021-34326" }, { "date": "2022-04-19T00:00:00", "db": "JVNDB", "id": "JVNDB-2021-009279" }, { "date": "2021-07-13T00:00:00", "db": "CNNVD", "id": "CNNVD-202107-923" }, { "date": "2021-04-13T00:00:00", "db": "CNNVD", "id": "CNNVD-202104-975" }, { "date": "2021-07-13T11:15:12.927000", "db": "NVD", "id": "CVE-2021-34326" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2021-07-19T00:00:00", "db": "ZDI", "id": "ZDI-21-864" }, { "date": "2021-07-19T00:00:00", "db": "VULMON", "id": "CVE-2021-34326" }, { "date": "2024-04-11T05:59:00", "db": "JVNDB", "id": "JVNDB-2021-009279" }, { "date": "2022-10-28T00:00:00", "db": "CNNVD", "id": "CNNVD-202107-923" }, { "date": "2021-04-14T00:00:00", "db": "CNNVD", "id": "CNNVD-202104-975" }, { "date": "2022-10-27T12:23:58.637000", "db": "NVD", "id": "CVE-2021-34326" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "local", "sources": [ { "db": "CNNVD", "id": "CNNVD-202107-923" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Out-of-bounds write vulnerabilities in multiple Siemens products", "sources": [ { "db": "JVNDB", "id": "JVNDB-2021-009279" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "buffer error", "sources": [ { "db": "CNNVD", "id": "CNNVD-202107-923" } ], "trust": 0.6 } }
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.