title: Datalogics Library APDFL Stack-based Buffer Overflow
description:
Datalogics Library APDFLThe v18.0.4PlusP1e and prior contains a stack-based buffer overflow due to documents containing corrupted fonts, which could allow an attack that causes an unhandled crash during the rendering process.
problem types: CWE-121: Stack-based Buffer Overflow
affected:
{
defaultStatus: unaffected
product: JT2Go
vendor: Siemens
versions:
lessThan: 14.2.0.2, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: Teamcenter Visualization
vendor: Siemens
versions:
lessThan: 13.2.0.13, status: affected, version: 13.2, versionType: custom
lessThan: 13.3.0.9, status: affected, version: 13.3, versionType: custom
lessThan: 14.0.0.5, status: affected, version: 14.0, versionType: custom
lessThan: 14.1.0.7, status: affected, version: 14.1, versionType: custom
lessThan: 14.2.0.2, status: affected, version: 14.2, versionType: custom
}
{
defaultStatus: unaffected
product: Library APDFL
vendor: Datalogics
versions:
lessThanOrEqual: v18.0.4PlusP1e, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Siemens has released updates for the affected products and recommends updating to the latest versions:
*  JT2Go:  Update to V14.2.0.2 https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html  or later version
*  Teamcenter Visualization V13.2:  Update to V13.2.0.13 https://support.sw.siemens.com/   or later version
*  Teamcenter Visualization V13.3:  Update to V13.3.0.9 https://support.sw.siemens.com/   or later version
*  Teamcenter Visualization V14.0:  Update to V14.0.0.5 https://support.sw.siemens.com/   or later version
*  Teamcenter Visualization V14.1:  Update to V14.1.0.7 https://support.sw.siemens.com/   or later version
*  Teamcenter Visualization V14.2:  Update to V14.2.0.2 https://support.sw.siemens.com/   or later version
workarounds: Siemens has identified the following specific workarounds and mitigations that users can apply to reduce risks:
*  Avoid opening untrusted files in JT2Go and Teamcenter Visualization
As a general security measure, Siemens recommends protecting
network access to devices with appropriate mechanisms. To operate the
devices in a protected IT environment, Siemens recommends configuring
the environment according to Siemens'  operational guidelines for industrial security https://www.siemens.com/cert/operational-guidelines-industrial-security ,
and to follow the recommendations in the product manuals. Additional
information on industrial security by Siemens can be found at the  Siemens Industrial Security web page https://www.siemens.com/industrialsecurity .
For further inquiries on security vulnerabilities in Siemens products and solutions, users should contact the  Siemens ProductCERT https://www.siemens.com/cert/advisories .