← Volver a CVEs
CVE-2021-34317
HIGH7.8
Descripcion
A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing PCX files. This could result in an out of bounds write past the fixed-length heap-based buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13402)
Detalles CVE
Puntuacion CVSS v3.17.8
SeveridadHIGH
Vector CVSSCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vector de ataqueLOCAL
ComplejidadLOW
Privilegios requeridosNONE
Interaccion usuarioREQUIRED
Publicado7/13/2021
Ultima modificacion11/21/2024
Fuentenvd
Avistamientos honeypot0
Productos afectados
siemens:jt2gosiemens:teamcenter_visualization
Debilidades (CWE)
CWE-122CWE-787
Referencias
https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf(productcert@siemens.com)
https://www.zerodayinitiative.com/advisories/ZDI-21-853/(productcert@siemens.com)
https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf(af854a3a-2127-422b-91ae-364da2661108)
https://www.zerodayinitiative.com/advisories/ZDI-21-853/(af854a3a-2127-422b-91ae-364da2661108)
Correlaciones IOC
Sin correlaciones registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.