IBM QRadar Network Security has addressed vulnerabilities in libtasn1.
CVEID: CVE-2015-3622**
DESCRIPTION:** GNU Libtasn1 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the _asn1_extract_der_octet() function. By sending an overly long string, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/102782> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVEID: CVE-2015-2806**
DESCRIPTION:** An unspecified error in libtasn1 related to asn1_der_decoding has an unknown impact and attack vector.
CVSS Base Score: 6.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/102548> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)
IBM QRadar Network Security 5.4
Product
| VRMF| Remediation/First Fix
—|—|—
IBM QRadar Network Security| Firmware version 5.4| Install Firmware 5.4.0.2 from the Available Updates page of the Local Management Interface, or by performing a One Time Scheduled Installation from SiteProtector.
Or
Download Firmware 5.4.0.2 from IBM Security License Key and Download Center and upload and install via the Available Updates page of the Local Management Interface.
None