Security Bulletin: IBM Flex System switch firmware products are affected by vulnerabilities in libxml2

Summary

Vulnerabilities in libxml2 have been addressed by IBM Flex System switch firmware products listed below.

Vulnerability Details

CVEID: CVE-2017-5130 DESCRIPTION: Google Chrome is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by libxml2. By persuading a victim to visit a specially-crafted Web site, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 6.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/133570&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)

CVEID: CVE-2017-16932 DESCRIPTION: Xmlsoft libxml2 is vulnerable to a denial of service, caused by an infinite recursion issue in parameter entities. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to exhaust available memory on the system.
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/135489&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2017-15412 DESCRIPTION: Google Chrome could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in libXML. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service.
CVSS Base Score: 6.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/136046&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)

CVEID: CVE-2016-5131 DESCRIPTION: Google Chrome could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in libxml. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service.
CVSS Base Score: 6.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/115396&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)

Affected Products and Versions

Product

|

Affected Version

—|—
IBM Flex System Fabric EN4093R 10Gb Scalable Switch firmware |

7.8

IBM Flex System EN2092 1Gb Ethernet Scalable firmware

|

7.8

IBM Flex System Fabric GbFSIM 10Gb Scalable Switch firmware

|

7.8

IBM Flex System CN4093 10Gb ScSE firmware

|

7.8

Remediation/Fixes

Firmware fix versions are available on Fix Central: <http://www.ibm.com/support/fixcentral/&gt;

Product

|

Fix Version

—|—

IBM Flex System Fabric EN4093R 10Gb Scalable Switch firmware
(ibm_fw_scsw_en4093r-7.8.20.0_anyos_noarch)

|

7.8.20.00

IBM Flex System EN2092 1Gb Ethernet Scalable firmware
(ibm_fw_scsw_en2092-7.8.20.0_anyos_noarch)

|

7.8.20.00

IBM Flex System Fabric GbFSIM 10Gb Scalable Switch firmware
(ibm_fw_scsw_si4093-7.8.20.0_anyos_noarch )

|

7.8.20.00

IBM Flex System CN4093 10Gb ScSE firmware
(ibm_fw_scsw_cn4093-7.8.20.0_anyos_noarch)

|

7.8.20.00

Workarounds and Mitigations

None