CVE-2021-44017: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Image.dll is vulnerable to an out of bounds read past the end of an...

Summary

A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Image.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted TIF files. An attacker could leverage this vulnerabili...

What to do

Update siemens jt2go to version 13.2.0.5 or later.
Update siemens teamcenter_visualization to version 13.2.0.5 or later.

Affected software

Vendor	Product	Affected versions
siemens	jt2go	< 13.2.0.5 `cpe:2.3:a:siemens:jt2go::::::::`
siemens	teamcenter_visualization	< 13.2.0.5 `cpe:2.3:a:siemens:teamcenter_visualization::::::::`

Original advisory text

A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Image.dll is vulnerable to an out of bounds read past the end of an...

A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Image.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted TIF files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15111)

References

https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf Patch Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-011/ Third Party Advisory VDB Entry