CVE-2020-26982

Опубликовано: 12 янв. 2021

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing CG4 and CGM files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-11898)

Ссылки

https://cert-portal.siemens.com/productcert/pdf/ssa-622830.pdf
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-052/
Third Party Advisory
VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-622830.pdf
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-052/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:siemens:jt2go:*:*:*:*:*:*:*:*

Версия до 13.1.0 (исключая)

cpe:2.3:a:siemens:teamcenter_visualization:*:*:*:*:*:*:*:*

Версия до 13.1.0 (исключая)

EPSS

Процентиль: 77%

0.01071

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-787

Связанные уязвимости

GHSA-cx8c-h5wc-m358

github

больше 3 лет назад

A vulnerability has been identified in JT2Go (All Versions < V13.1.0), Teamcenter Visualization (All Versions < V13.1.0). Affected applications lack proper validation of user-supplied data when parsing CG4 and CGM files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.