CVE-2022-3159 - The APDFL.dll contains a stack-based buffer overflow vulnerability that

Back Back to CVE browser

HIGH

The APDFL.dll contains a stack-based buffer overflow vulnerability that

Published Jan 13, 2023

7.8

HIGH

CVSS 3.1

EPSS 0.47%

Description

The APDFL.dll contains a stack-based buffer overflow vulnerability that could be triggered while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.

Affected products

Vendor Siemens Product JT2Go Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <14.1.0.5
Vendor Siemens Product Teamcenter Visualization V13.3 Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <13.3.0.8
Vendor Siemens Product Teamcenter Visualization V14.0 Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <14.0.0.4
Vendor Siemens Product Teamcenter Visualization V14.1 Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <14.1.0.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Siemens

JT2Go

unaffected

Version	Status	Constraints
0	affected	<14.1.0.5

Siemens

Teamcenter Visualization V13.3

unaffected

Version	Status	Constraints
0	affected	<13.3.0.8

Siemens

Teamcenter Visualization V14.0

unaffected

Version	Status	Constraints
0	affected	<14.0.0.4

Siemens

Teamcenter Visualization V14.1

unaffected

Version	Status	Constraints
0	affected	<14.1.0.5

Remediation

Vendor solution

Siemens released updates for the affected products and recommends updating to the latest versions: * JT2Go: Update to V14.1.0.5 or later version https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html .

* Teamcenter Visualization V13.3: Update to V13.3.0.8 or later version https://support.sw.siemens.com/ .

* Teamcenter Visualization V14.0: Update to V14.0.0.4 or later version https://support.sw.siemens.com/ .

* Teamcenter Visualization V14.1: Update to V14.1.0.5 or later version https://support.sw.siemens.com/ .

Weaknesses (2)

CWE-121

CWE-787

Out-of-bounds Write

References (3)

https://cert-portal.siemens.com/productcert/csaf/ssa-360681.json
Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-360681.html
PatchThird Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-15
Third Party AdvisoryUS Government Resource

Link	Providers	Tags
https://cert-portal.siemens.com/productcert/csaf/ssa-360681.json		Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-360681.html		PatchThird Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-15		Third Party AdvisoryUS Government Resource