Details of VAR-202211-0306

ID

VAR-202211-0306

CVE

CVE-2022-41664

TITLE

Siemens' JT2Go and Teamcenter Visualization Out-of-bounds write vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-022824

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V13.3 (All versions < V13.3.0.7), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1.0.4). The affected application contains a stack-based buffer overflow vulnerability that could be triggered while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process. Siemens' JT2Go and Teamcenter Visualization Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2022-41664 // JVNDB: JVNDB-2022-022824

AFFECTED PRODUCTS

vendor:	siemens	model:	jt2go	scope:	lt	version:	14.1.0.4	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	13.3.0.7	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	14.1	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	14.1.0.4	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	14.0	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	13.3.0	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	14.0.0.3	Trust: 1.0
vendor:	シーメンス	model:	teamcenter visualization	scope:	-	version:	-	Trust: 0.8
vendor:	シーメンス	model:	jt2go	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-022824 // NVD: CVE-2022-41664

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2022-41664
value:	HIGH
Trust: 1.8
productcert@siemens.com:	CVE-2022-41664
value:	HIGH
Trust: 1.0
CNNVD:	CNNVD-202211-2319
value:	HIGH
Trust: 0.6

NVD:
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 2.0
NVD:	CVE-2022-41664
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2022-022824 // NVD: CVE-2022-41664 // NVD: CVE-2022-41664 // CNNVD: CNNVD-202211-2319

PROBLEMTYPE DATA

problemtype:	CWE-787	Trust: 1.0
problemtype:	Out-of-bounds writing (CWE-787) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2022-022824 // NVD: CVE-2022-41664

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202211-2319

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202211-2319

CONFIGURATIONS

sources: NVD: CVE-2022-41664

PATCH

title:

Siemens JT2Go and Teamcenter Visualization Buffer error vulnerability fix

url:

http://123.124.177.30/web/xxk/bdxqbyid.tag?id=213373

Trust: 0.6

sources: CNNVD: CNNVD-202211-2319

EXTERNAL IDS

db:	NVD	id:	CVE-2022-41664	Trust: 3.2
db:	SIEMENS	id:	SSA-120378	Trust: 2.4
db:	ICS CERT	id:	ICSA-22-314-09	Trust: 0.8
db:	JVN	id:	JVNVU93762879	Trust: 0.8
db:	JVNDB	id:	JVNDB-2022-022824	Trust: 0.8
db:	CNNVD	id:	CNNVD-202211-2319	Trust: 0.6

sources: JVNDB: JVNDB-2022-022824 // NVD: CVE-2022-41664 // CNNVD: CNNVD-202211-2319

REFERENCES

url:	https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf	Trust: 2.4
url:	https://jvn.jp/vu/jvnvu93762879/	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2022-41664	Trust: 0.8
url:	https://www.cisa.gov/news-events/ics-advisories/icsa-22-314-09	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2022-41664/	Trust: 0.6

sources: JVNDB: JVNDB-2022-022824 // NVD: CVE-2022-41664 // CNNVD: CNNVD-202211-2319

SOURCES

db:	JVNDB	id:	JVNDB-2022-022824
db:	NVD	id:	CVE-2022-41664
db:	CNNVD	id:	CNNVD-202211-2319

LAST UPDATE DATE

2023-12-18T10:47:26.195000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2022-022824	date:	2023-11-21T01:47:00
db:	NVD	id:	CVE-2022-41664	date:	2023-06-13T09:15:15.310
db:	CNNVD	id:	CNNVD-202211-2319	date:	2023-06-14T00:00:00

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2022-022824	date:	2023-11-21T00:00:00
db:	NVD	id:	CVE-2022-41664	date:	2022-11-08T11:15:11.813
db:	CNNVD	id:	CNNVD-202211-2319	date:	2022-11-08T00:00:00