CVE-2022-3159

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The APDFL.dll contains a stack-based buffer overflow vulnerability that could be triggered while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
Siemens	JT2Go	< 14.1.0.5
Siemens	Teamcenter Visualization V13.3	< 13.3.0.8
Siemens	Teamcenter Visualization V14.0	< 14.0.0.4
Siemens	Teamcenter Visualization V14.1	< 14.1.0.5

References

https://cert-portal.siemens.com/productcert/csaf/ssa-360681.jsonThird Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-360681.htmlPatch, Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-15Third Party Advisory, US Government Resource
https://cert-portal.siemens.com/productcert/csaf/ssa-360681.jsonThird Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-360681.htmlPatch, Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-15Third Party Advisory, US Government Resource

Timeline

Published: Jan 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-315907.8SAP PowerDesigner Proxy - version 16.7, allows an attacker with low privileges and has local access, with the ability to work around system’CVE-2022-315917.8SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A local attacker can gai CVE-2022-315924.3The application SAP Enterprise Extension Defense Forces & Public Security - versions 605, 606, 616,617,618, 802, 803, 804, 805, 806, does no CVE-2022-315938.8SAP Business One client - version 10.0 allows an attacker with low privileges, to inject code that can be executed by the application. An at CVE-2022-315946.7A highly privileged user can exploit SUID-root program to escalate his privileges to root on a local Unix system.CVE-2022-315958.8SAP Financial Consolidation - version 1010,�does not perform necessary authorization checks for an authenticated user, resulting in escalati CVE-2022-315966.0Under certain conditions, an attacker authenticated as a CMS administrator and with high privileges access to the Network in SAP BusinessObj CVE-2022-315975.4Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner extension for Spain/Slovak CVE-2022-315985.4Due to insufficient input validation, SAP Business Objects - version 420, allows an authenticated attacker to submit a malicious request thr CVE-2022-315998.2NVIDIA DGX A100 contains a vulnerability in SBIOS in the Ofbd, where a local user with elevated privileges can cause access to an uninitiali CVE-2022-31607.8The APDFL.dll contains an out-of-bounds write past the fixed-length heap-based buffer while parsing specially crafted PDF files. This could CVE-2022-316008.2NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vulnerability to this