CVE-2021-44017

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Image.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted TIF files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15111)

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Siemens	JT2Go	All versions < V13.2.0.5
Siemens	Teamcenter Visualization	All versions < V13.2.0.5

References

https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdfPatch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-011/Third Party Advisory, VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdfPatch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-011/Third Party Advisory, VDB Entry

Timeline

Published: Dec 14, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-440187.8A vulnerability has been identified in JT2Go (All versions < V13.2.0.7), Solid Edge SE2021 (All versions < SE2021MP9), Solid Edge SE2022 (Al CVE-2021-440197.8An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privile CVE-2021-44024.3The Multiple Roles plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.1. This is due to CVE-2021-440207.8An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privile CVE-2021-440217.8An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privile CVE-2021-440225.5A reachable assertion vulnerability in Trend Micro Apex One could allow an attacker to crash the program on affected installations, leading CVE-2021-440237.1A link following denial-of-service (DoS) vulnerability in the Trend Micro Security (Consumer) 2021 familiy of products could allow an attack CVE-2021-440247.1A link following denial-of-service vulnerability in Trend Micro Apex One (on-prem and SaaS) and Trend Micro Worry-Free Business Security (10 CVE-2021-440256.1Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type w CVE-2021-440269.8Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.CVE-2021-440285.5XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a relat CVE-2021-440299.8An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remote code through a de