Details of VAR-202308-0231

ID

VAR-202308-0231

CVE

CVE-2023-38682

TITLE

Siemens' JT2Go and Teamcenter Visualization Out-of-bounds read vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2023-021428

DESCRIPTION

A vulnerability has been identified in JT2Go (All versions < V14.2.0.5), Teamcenter Visualization V13.2 (All versions < V13.2.0.14), Teamcenter Visualization V14.1 (All versions < V14.1.0.10), Teamcenter Visualization V14.2 (All versions < V14.2.0.5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted TIFF files. This could allow an attacker to execute code in the context of the current process. Siemens' JT2Go and Teamcenter Visualization Exists in an out-of-bounds read vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.71

sources: NVD: CVE-2023-38682 // JVNDB: JVNDB-2023-021428 // VULMON: CVE-2023-38682

AFFECTED PRODUCTS

vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	14.1.0.10	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	14.1	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	lt	version:	14.2.0.5	Trust: 1.0
vendor:	siemens	model:	teamcenter visualization	scope:	gte	version:	14.2	Trust: 1.0
vendor:	siemens	model:	jt2go	scope:	lt	version:	14.2.0.5	Trust: 1.0
vendor:	シーメンス	model:	jt2go	scope:	-	version:	-	Trust: 0.8
vendor:	シーメンス	model:	teamcenter visualization	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2023-021428 // NVD: CVE-2023-38682

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2023-38682
value:	HIGH
Trust: 1.8
productcert@siemens.com:	CVE-2023-38682
value:	HIGH
Trust: 1.0

NVD:
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 2.0
NVD:	CVE-2023-38682
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2023-021428 // NVD: CVE-2023-38682 // NVD: CVE-2023-38682

PROBLEMTYPE DATA

problemtype:	CWE-125	Trust: 1.0
problemtype:	Out-of-bounds read (CWE-125) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2023-021428 // NVD: CVE-2023-38682

CONFIGURATIONS

sources: NVD: CVE-2023-38682

EXTERNAL IDS

db:	NVD	id:	CVE-2023-38682	Trust: 2.7
db:	SIEMENS	id:	SSA-131450	Trust: 1.9
db:	JVN	id:	JVNVU90056839	Trust: 0.8
db:	ICS CERT	id:	ICSA-23-222-01	Trust: 0.8
db:	JVNDB	id:	JVNDB-2023-021428	Trust: 0.8
db:	VULMON	id:	CVE-2023-38682	Trust: 0.1

sources: VULMON: CVE-2023-38682 // JVNDB: JVNDB-2023-021428 // NVD: CVE-2023-38682

REFERENCES

url:	https://cert-portal.siemens.com/productcert/pdf/ssa-131450.pdf	Trust: 1.9
url:	https://jvn.jp/vu/jvnvu90056839/	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2023-38682	Trust: 0.8
url:	https://www.cisa.gov/news-events/ics-advisories/icsa-23-222-01	Trust: 0.8
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2023-38682 // JVNDB: JVNDB-2023-021428 // NVD: CVE-2023-38682

SOURCES

db:	VULMON	id:	CVE-2023-38682
db:	JVNDB	id:	JVNDB-2023-021428
db:	NVD	id:	CVE-2023-38682

LAST UPDATE DATE

2024-01-20T20:35:34.613000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2023-38682	date:	2023-08-08T00:00:00
db:	JVNDB	id:	JVNDB-2023-021428	date:	2024-01-19T05:42:00
db:	NVD	id:	CVE-2023-38682	date:	2023-08-14T18:53:21.687

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2023-38682	date:	2023-08-08T00:00:00
db:	JVNDB	id:	JVNDB-2023-021428	date:	2024-01-19T00:00:00
db:	NVD	id:	CVE-2023-38682	date:	2023-08-08T10:15:16.887