var-202202-0028
Vulnerability from variot
The Datalogics APDFL library used in affected products is vulnerable to memory corruption condition while parsing specially crafted PDF files. An attacker could leverage this vulnerability to execute code in the context of the current process. Siemens' JT2Go and Teamcenter Visualization Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202202-0028",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "jt2go",
"scope": null,
"trust": 2.1,
"vendor": "siemens",
"version": null
},
{
"model": "teamcenter visualization",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "13.3.0"
},
{
"model": "jt2go",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "13.2.0.7"
},
{
"model": "teamcenter visualization",
"scope": "gte",
"trust": 1.0,
"vendor": "siemens",
"version": "13.2.0"
},
{
"model": "teamcenter visualization",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "13.1.0.8"
},
{
"model": "teamcenter visualization",
"scope": "gte",
"trust": 1.0,
"vendor": "siemens",
"version": "13.1.0"
},
{
"model": "teamcenter visualization",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "13.2.0.7"
},
{
"model": "teamcenter visualization",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
"version": null
},
{
"model": "jt2go",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-339"
},
{
"db": "ZDI",
"id": "ZDI-22-337"
},
{
"db": "ZDI",
"id": "ZDI-22-336"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-020743"
},
{
"db": "NVD",
"id": "CVE-2021-38405"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "13.2.0.7",
"versionStartIncluding": "13.2.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "13.2.0.7",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:teamcenter_visualization:13.3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "13.1.0.8",
"versionStartIncluding": "13.1.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2021-38405"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mat Powell of Trend Micro Zero Day Initiative",
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-339"
},
{
"db": "ZDI",
"id": "ZDI-22-337"
},
{
"db": "ZDI",
"id": "ZDI-22-336"
},
{
"db": "CNNVD",
"id": "CNNVD-202202-946"
}
],
"trust": 2.7
},
"cve": "CVE-2021-38405",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"exploitabilityScore": 1.8,
"id": "CVE-2021-38405",
"impactScore": 1.4,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.4,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2021-38405",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2021-38405",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2021-38405",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2021-38405",
"trust": 1.4,
"value": "LOW"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2021-38405",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2021-38405",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202202-946",
"trust": 0.6,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-339"
},
{
"db": "ZDI",
"id": "ZDI-22-337"
},
{
"db": "ZDI",
"id": "ZDI-22-336"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-020743"
},
{
"db": "CNNVD",
"id": "CNNVD-202202-946"
},
{
"db": "NVD",
"id": "CVE-2021-38405"
},
{
"db": "NVD",
"id": "CVE-2021-38405"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Datalogics APDFL library used in affected products is vulnerable to memory corruption condition\u00a0while parsing specially crafted PDF files. An attacker could leverage this vulnerability to execute code\u00a0in the context of the current process. Siemens\u0027 JT2Go and Teamcenter Visualization Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-38405"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-020743"
},
{
"db": "ZDI",
"id": "ZDI-22-339"
},
{
"db": "ZDI",
"id": "ZDI-22-337"
},
{
"db": "ZDI",
"id": "ZDI-22-336"
},
{
"db": "VULMON",
"id": "CVE-2021-38405"
}
],
"trust": 3.6
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2021-38405",
"trust": 5.4
},
{
"db": "ICS CERT",
"id": "ICSA-22-041-07",
"trust": 2.5
},
{
"db": "SIEMENS",
"id": "SSA-301589",
"trust": 1.9
},
{
"db": "ZDI",
"id": "ZDI-22-339",
"trust": 1.3
},
{
"db": "ZDI",
"id": "ZDI-22-336",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU98748974",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2021-020743",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-15113",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-15108",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-22-337",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-15106",
"trust": 0.7
},
{
"db": "CS-HELP",
"id": "SB2022021109",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202202-946",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2021-38405",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-339"
},
{
"db": "ZDI",
"id": "ZDI-22-337"
},
{
"db": "ZDI",
"id": "ZDI-22-336"
},
{
"db": "VULMON",
"id": "CVE-2021-38405"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-020743"
},
{
"db": "CNNVD",
"id": "CNNVD-202202-946"
},
{
"db": "NVD",
"id": "CVE-2021-38405"
}
]
},
"id": "VAR-202202-0028",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.15799868
},
"last_update_date": "2024-01-18T19:33:14.808000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Siemens has issued an update to correct this vulnerability.",
"trust": 2.1,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf"
},
{
"title": "Siemens Jt2go Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=182233"
},
{
"title": "Siemens Security Advisories: Siemens Security Advisory",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=fefc850707fc7ccce29d30c42162ee31"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-339"
},
{
"db": "ZDI",
"id": "ZDI-22-337"
},
{
"db": "ZDI",
"id": "ZDI-22-336"
},
{
"db": "VULMON",
"id": "CVE-2021-38405"
},
{
"db": "CNNVD",
"id": "CNNVD-202202-946"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "Out-of-bounds writing (CWE-787) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-020743"
},
{
"db": "NVD",
"id": "CVE-2021-38405"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.0,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf"
},
{
"trust": 1.9,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-041-07"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98748974/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-38405"
},
{
"trust": 0.6,
"url": "https://www.zerodayinitiative.com/advisories/zdi-22-339/"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022021109"
},
{
"trust": 0.6,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-041-07-1"
},
{
"trust": 0.6,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-041-07-0"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.zerodayinitiative.com/advisories/zdi-22-336/"
},
{
"trust": 0.1,
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-041-07"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-339"
},
{
"db": "ZDI",
"id": "ZDI-22-337"
},
{
"db": "ZDI",
"id": "ZDI-22-336"
},
{
"db": "VULMON",
"id": "CVE-2021-38405"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-020743"
},
{
"db": "CNNVD",
"id": "CNNVD-202202-946"
},
{
"db": "NVD",
"id": "CVE-2021-38405"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-22-339"
},
{
"db": "ZDI",
"id": "ZDI-22-337"
},
{
"db": "ZDI",
"id": "ZDI-22-336"
},
{
"db": "VULMON",
"id": "CVE-2021-38405"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-020743"
},
{
"db": "CNNVD",
"id": "CNNVD-202202-946"
},
{
"db": "NVD",
"id": "CVE-2021-38405"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-02-15T00:00:00",
"db": "ZDI",
"id": "ZDI-22-339"
},
{
"date": "2022-02-15T00:00:00",
"db": "ZDI",
"id": "ZDI-22-337"
},
{
"date": "2022-02-15T00:00:00",
"db": "ZDI",
"id": "ZDI-22-336"
},
{
"date": "2023-11-21T00:00:00",
"db": "VULMON",
"id": "CVE-2021-38405"
},
{
"date": "2024-01-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-020743"
},
{
"date": "2022-02-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202202-946"
},
{
"date": "2023-11-21T19:15:07.647000",
"db": "NVD",
"id": "CVE-2021-38405"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-02-15T00:00:00",
"db": "ZDI",
"id": "ZDI-22-339"
},
{
"date": "2022-02-15T00:00:00",
"db": "ZDI",
"id": "ZDI-22-337"
},
{
"date": "2022-02-15T00:00:00",
"db": "ZDI",
"id": "ZDI-22-336"
},
{
"date": "2023-11-21T00:00:00",
"db": "VULMON",
"id": "CVE-2021-38405"
},
{
"date": "2024-01-11T06:17:00",
"db": "JVNDB",
"id": "JVNDB-2021-020743"
},
{
"date": "2022-02-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202202-946"
},
{
"date": "2023-11-30T05:39:30.360000",
"db": "NVD",
"id": "CVE-2021-38405"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Siemens JT2Go PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-339"
},
{
"db": "ZDI",
"id": "ZDI-22-337"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202202-946"
}
],
"trust": 0.6
}
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.