title: Siemens Solid Edge, JT2Go, and Teamcenter Visualization Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The Datalogics APDFL library used in affected products is vulnerable to memory corruption condition while parsing specially crafted PDF files. An attacker could leverage this vulnerability to execute code in the context of the current process.
problem types: CWE-119
affected:
{
defaultStatus: unaffected
product: JT2Go
vendor: Siemens
versions:
lessThan: 13.2.0.7, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: Teamcenter Visualization
vendor: Siemens
versions:
lessThan: 12.4.0.13, status: affected, version: 12.4, versionType: custom
lessThan: 13.1.0.8, status: affected, version: 13.1, versionType: custom
lessThan: 13.2.0.7, status: affected, version: 13.2, versionType: custom
lessThan: 13.3.0.1, status: affected, version: 13.3, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Siemens has released updates for some of the affected products and
recommends updating to the latest versions. Siemens is preparing further
updates and recommends specific countermeasures for products where
updates are not yet available.
*  JT2Go:  Update to v13.2.0.7 https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html  or later version
*  Teamcenter Visualization v13.1:  Update to v13.1.0.9 or later version https://support.sw.siemens.com/
*  Teamcenter Visualization v13.2:  Update to v13.2.0.7 or later version https://support.sw.siemens.com/
*  Teamcenter Visualization v13.3:  Update to v13.3.0.1 or later version https://support.sw.siemens.com/
Please see Siemens security advisory  SSA-301589 https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf  for more information.
workarounds: Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk:
*  Avoid opening untrusted files from unknown sources in affected products.
As a general security measure, Siemens strongly recommends
protecting network access to devices with appropriate mechanisms. In
order to operate the devices in a protected IT environment, Siemens
recommends configuring the environment according to  Siemens’ operational guidelines for industrial security https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf , and to follow the recommendations in the product manuals.
Additional information on industrial security by Siemens can be found on the  Siemens industrial security webpage https://www.siemens.com/industrialsecurity .
Please see Siemens security advisory  SSA-301589 https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf  for more information.
