Security Bulletin: Multiple vulnerabilities in XMLsoft Libxml2 affect IBM Streams

Summary

There are multiple vulnerabilities in Libxml2 library used by IBM Streams. IBM Streams has addressed the applicable CVEs.

Vulnerability Details

CVE-ID: CVE-2016-2073
Description: libxml2 is vulnerable to a heap-based buffer overflow, caused by an out-of-bounds read in the htmlParseNameComplex() function. By persuading a victim to open a specially crafted XML file, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 6.300
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/110307&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)

CVE-ID: CVE-2016-9318
Description: Libxml2 could allow a remote attacker to obtain sensitive information, caused by failure to offer a flag directly indicating the status of current document. By using a specially-crafted document to conduct a XML external entity (XXE) attack, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base Score: 5.500
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/119018 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Affected Products and Versions

The following versions may be impacted:

• IBM Streams Version 4.2.1.2 and earlier
• IBM InfoSphere Streams Version 4.1.1.4 and earlier
• IBM InfoSphere Streams Version 4.0.1.4 and earlier
• IBM InfoSphere Streams Version 3.2.1.6 and earlier
• IBM InfoSphere Streams Version 3.1.0.8 and earlier
• IBM InfoSphere Streams Version 3.0.0.6 and earlier

Remediation/Fixes

NOTE: Fix Packs are available on IBM Fix Central.

To remediate/fix this issue, follow the instructions below:

• Version 4.2.x: Apply 4.2.1 Fix Pack 3 (4.2.1.3) or higher.
• Version 4.1.x: Apply 4.1.1 Fix Pack 5 (4.1.1.5) or higher.
• Version 4.0.x: Apply 4.0.1 Fix Pack 5 (4.0.1.5) or higher.
• Versions 3.2.x, 3.1.x, and 3.0.x: For versions earlier than 4.x.x, IBM recommends upgrading to a fixed, supported version/release/platform of the product. Customers who cannot upgrade and need to secure their installation should open a PMR with IBM Technical Support and request assistance securing their InfoSphere Streams system against the vulnerabilities identified in this Security Bulletin.

Workarounds and Mitigations

None