CVE-2021-34302: siemens jt2go Buffer Over-read

Vulnerability summary

CVE-2021-34302 is a medium (CVSS 5.5) Buffer Over-read vulnerability in siemens jt2go. EPSS estimates a 1.42% chance of exploitation in the next 30 days, higher than 72.4% of scored vulnerabilities.

Timeline

1. 13-07-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-13197)

• CWE-126Buffer Over-readThe product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.