description: The APDFL.dll contains a stack-based buffer overflow vulnerability that
could be triggered while parsing specially crafted PDF files. This could
allow an attacker to execute code in the context of the current
process.
problem types: CWE-121
affected:
{
defaultStatus: unaffected
product: JT2Go
vendor: Siemens
versions:
lessThan: 14.1.0.5, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: Teamcenter Visualization V13.3
vendor: Siemens
versions:
lessThan: 13.3.0.8, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: Teamcenter Visualization V14.0
vendor: Siemens
versions:
lessThan: 14.0.0.4, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: Teamcenter Visualization V14.1
vendor: Siemens
versions:
lessThan: 14.1.0.5, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Siemens released updates for the affected products and recommends updating to the latest versions:
*  JT2Go:  Update to V14.1.0.5 or later version https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html .
*  Teamcenter Visualization V13.3:  Update to V13.3.0.8 or later version https://support.sw.siemens.com/ .
*  Teamcenter Visualization V14.0:  Update to V14.0.0.4 or later version https://support.sw.siemens.com/ .
*  Teamcenter Visualization V14.1:  Update to V14.1.0.5 or later version https://support.sw.siemens.com/ .
workarounds: Siemens identified the following specific workaround and mitigation user can apply to reduce risk:
*  Do not open untrusted PDF files in JT2Go and Teamcenter Visualization.
As a general security measure, Siemens recommends protecting
network access to devices with appropriate mechanisms. To operate the
devices in a protected IT environment, Siemens recommends configuring
the environment according to Siemens'  operational guidelines for industrial security https://www.siemens.com/cert/operational-guidelines-industrial-security
and following the recommendations in the product manuals. Siemens also provides  additional information on industrial security https://www.siemens.com/industrialsecurity .
For further inquiries on security vulnerabilities in Siemens products, users should contact  Siemens https://www.siemens.com/cert/advisories .
For more information, see the associated Siemens security advisory SSA-360681 in  HTML  https://cert-portal.siemens.com/productcert/html/ssa-360681.html and  CSAF https://cert-portal.siemens.com/productcert/csaf/ssa-360681.json .