Details of VAR-202212-1728

ID

VAR-202212-1728

CVE

CVE-2022-3161

TITLE

Siemens Teamcenter Visualization and JT2Go Out-of-bounds write vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-005661

DESCRIPTION

The APDFL.dll contains a memory corruption vulnerability while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process. Siemens Teamcenter Visualization and JT2Go Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Siemens Teamcenter Visualization and JT2Go

Trust: 1.71

sources: NVD: CVE-2022-3161 // JVNDB: JVNDB-2022-005661 // VULMON: CVE-2022-3161

AFFECTED PRODUCTS

vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	14.1.0.5	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	13.3.0.8	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	13.3.0	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	14.1	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	14.0	Trust: 1.0
vendor:	siemens	model:	jt2go	scope:	lt	version:	14.1.0.5	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	14.0.0.4	Trust: 1.0
vendor:	シーメンス	model:	teamcenter visualization	scope:	-	version:	-	Trust: 0.8
vendor:	シーメンス	model:	jt2go	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-005661 // NVD: CVE-2022-3161

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2022-3161
value:	HIGH
Trust: 1.0
ics-cert@hq.dhs.gov:	CVE-2022-3161
value:	HIGH
Trust: 1.0
OTHER:	JVNDB-2022-005661
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202301-1070
value:	HIGH
Trust: 0.6

NVD:
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 2.0
OTHER:	JVNDB-2022-005661
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2022-005661 // NVD: CVE-2022-3161 // NVD: CVE-2022-3161 // CNNVD: CNNVD-202301-1070

PROBLEMTYPE DATA

problemtype:	CWE-787	Trust: 1.0
problemtype:	Out-of-bounds writing (CWE-787) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2022-005661 // NVD: CVE-2022-3161

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202301-1070

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202301-1070

CONFIGURATIONS

sources: NVD: CVE-2022-3161

PATCH

title:	SSA-360681	url:	https://cert-portal.siemens.com/productcert/html/ssa-360681.html	Trust: 0.8
title:	Siemens Teamcenter Visualization and JT2Go Buffer error vulnerability fix	url:	http://123.124.177.30/web/xxk/bdxqbyid.tag?id=222349	Trust: 0.6

sources: JVNDB: JVNDB-2022-005661 // CNNVD: CNNVD-202301-1070

EXTERNAL IDS

db:	NVD	id:	CVE-2022-3161	Trust: 3.3
db:	ICS CERT	id:	ICSA-22-349-15	Trust: 2.5
db:	SIEMENS	id:	SSA-360681	Trust: 1.6
db:	JVN	id:	JVNVU91561630	Trust: 0.8
db:	JVNDB	id:	JVNDB-2022-005661	Trust: 0.8
db:	CNNVD	id:	CNNVD-202301-1070	Trust: 0.6
db:	VULMON	id:	CVE-2022-3161	Trust: 0.1

sources: VULMON: CVE-2022-3161 // JVNDB: JVNDB-2022-005661 // NVD: CVE-2022-3161 // CNNVD: CNNVD-202301-1070

REFERENCES

url:	https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-15	Trust: 1.7
url:	https://cert-portal.siemens.com/productcert/csaf/ssa-360681.json	Trust: 1.6
url:	https://cert-portal.siemens.com/productcert/html/ssa-360681.html	Trust: 1.6
url:	https://jvn.jp/vu/jvnvu91561630/index.html	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2022-3161	Trust: 0.8
url:	https://www.cisa.gov/news-events/ics-advisories/icsa-22-349-15	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2022-3161/	Trust: 0.6

sources: VULMON: CVE-2022-3161 // JVNDB: JVNDB-2022-005661 // NVD: CVE-2022-3161 // CNNVD: CNNVD-202301-1070

SOURCES

db:	VULMON	id:	CVE-2022-3161
db:	JVNDB	id:	JVNDB-2022-005661
db:	NVD	id:	CVE-2022-3161
db:	CNNVD	id:	CNNVD-202301-1070

LAST UPDATE DATE

2023-12-18T11:24:35.332000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2022-005661	date:	2023-06-08T02:23:00
db:	NVD	id:	CVE-2022-3161	date:	2023-11-07T03:50:53.490
db:	CNNVD	id:	CNNVD-202301-1070	date:	2023-01-28T00:00:00

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2022-005661	date:	2023-06-08T00:00:00
db:	NVD	id:	CVE-2022-3161	date:	2023-01-13T01:15:09.770
db:	CNNVD	id:	CNNVD-202301-1070	date:	2023-01-13T00:00:00