Details of VAR-202211-0307

ID

VAR-202211-0307

CVE

CVE-2022-39136

TITLE

Siemens' JT2Go and Teamcenter Visualization Out-of-bounds write vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-022837

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V13.3 (All versions < V13.3.0.7), Teamcenter Visualization V13.3 (All versions >= V13.3.0.7 < V13.3.0.8), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1.0.4). The affected application is vulnerable to fixed-length heap-based buffer while parsing specially crafted TIF files. An attacker could leverage this vulnerability to execute code in the context of the current process. Siemens' JT2Go and Teamcenter Visualization Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2022-39136 // JVNDB: JVNDB-2022-022837

AFFECTED PRODUCTS

vendor:	siemens	model:	teamcenter visualization	scope:	lte	version:	13.3.0.7	Trust: 1.0
vendor:	siemens	model:	jt2go	scope:	lt	version:	14.1.0.4	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	14.1	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	14.1.0.4	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	14.0	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	14.0.0.3	Trust: 1.0
vendor:	シーメンス	model:	teamcenter visualization	scope:	-	version:	-	Trust: 0.8
vendor:	シーメンス	model:	jt2go	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-022837 // NVD: CVE-2022-39136

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2022-39136
value:	HIGH
Trust: 1.8
productcert@siemens.com:	CVE-2022-39136
value:	HIGH
Trust: 1.0
CNNVD:	CNNVD-202211-2320
value:	HIGH
Trust: 0.6

NVD:
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 2.0
NVD:	CVE-2022-39136
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2022-022837 // NVD: CVE-2022-39136 // NVD: CVE-2022-39136 // CNNVD: CNNVD-202211-2320

PROBLEMTYPE DATA

problemtype:	CWE-787	Trust: 1.0
problemtype:	Out-of-bounds writing (CWE-787) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2022-022837 // NVD: CVE-2022-39136

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202211-2320

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202211-2320

CONFIGURATIONS

sources: NVD: CVE-2022-39136

PATCH

title:

Siemens JT2Go and Teamcenter Visualization Buffer error vulnerability fix

url:

http://123.124.177.30/web/xxk/bdxqbyid.tag?id=213374

Trust: 0.6

sources: CNNVD: CNNVD-202211-2320

EXTERNAL IDS

db:	NVD	id:	CVE-2022-39136	Trust: 3.2
db:	SIEMENS	id:	SSA-120378	Trust: 2.4
db:	ICS CERT	id:	ICSA-22-314-09	Trust: 0.8
db:	JVN	id:	JVNVU93762879	Trust: 0.8
db:	JVNDB	id:	JVNDB-2022-022837	Trust: 0.8
db:	CNNVD	id:	CNNVD-202211-2320	Trust: 0.6

sources: JVNDB: JVNDB-2022-022837 // NVD: CVE-2022-39136 // CNNVD: CNNVD-202211-2320

REFERENCES

url:	https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf	Trust: 2.4
url:	https://jvn.jp/vu/jvnvu93762879/	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2022-39136	Trust: 0.8
url:	https://www.cisa.gov/news-events/ics-advisories/icsa-22-314-09	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2022-39136/	Trust: 0.6

sources: JVNDB: JVNDB-2022-022837 // NVD: CVE-2022-39136 // CNNVD: CNNVD-202211-2320

SOURCES

db:	JVNDB	id:	JVNDB-2022-022837
db:	NVD	id:	CVE-2022-39136
db:	CNNVD	id:	CNNVD-202211-2320

LAST UPDATE DATE

2023-12-18T11:29:39.580000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2022-022837	date:	2023-11-21T01:52:00
db:	NVD	id:	CVE-2022-39136	date:	2023-06-13T09:15:14.517
db:	CNNVD	id:	CNNVD-202211-2320	date:	2023-06-14T00:00:00

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2022-022837	date:	2023-11-21T00:00:00
db:	NVD	id:	CVE-2022-39136	date:	2022-11-08T11:15:11.247
db:	CNNVD	id:	CNNVD-202211-2320	date:	2022-11-08T00:00:00