CVE-2021-34333: Double Free
A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMPLoader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. A malformed input file could result in double free of an allocated buffer that leads to a crash. An attacker could leverage this vulnerability to cause denial of service condition. (CNVD-C-2021-79295)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-34333?
The severity of CVE-2021-34333 is medium with a severity value of 5.5.
Which software versions are affected by CVE-2021-34333?
CVE-2021-34333 affects JT2Go versions up to exclusive 13.2 and Teamcenter Visualization versions up to exclusive 13.2.
What is the vulnerability in JT2Go and Teamcenter Visualization?
The vulnerability in JT2Go and Teamcenter Visualization is due to the lack of proper validation of user-supplied data when parsing BMP files in the BMP_Loader.dll library.
What could happen if a malformed input file is processed?
If a malformed input file is processed, it could result in a double free of an allocated memory, leading to a potential security compromise.
Where can I find more information about CVE-2021-34333?
You can find more information about CVE-2021-34333 in the Siemens ProductCERT security advisory at the following link: [Siemens ProductCERT Security Advisory](https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf)