Security Bulletin
Summary
Open Source Xerces-C XML parser vulnerability affects IBM InfoSphere Optim Masking On Demand (Data Privacy components).
Vulnerability Details
CVEID: CVE-2016-0729
DESCRIPTION: Apache Xerces-C XML Parser library is vulnerable to a denial of service, caused by improper bounds checking during processing and error reporting. By sending specially crafted input documents, an attacker could exploit this vulnerability to cause the library to crash or possibly execute arbitrary code on the system.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111028 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Affected Products and Versions
Affects IBM InfoSphere Optim Masking On Demand versions 9.1 and 11.3 running on all supported platforms.
Remediation/Fixes
For the 11.3 release, fix pack 4 (11.3.0.4) is required before installing iFix 12.
For the 9.1 release, fix pack 6 (9.1.0.6) is required before installing iFix 11.
| Product | VRMF | iFix | Remediation/First Fix |
| IBM InfoSphere Optim Masking On Demand | 11.3 | 12 | - Apply IBM InfoSphere Optim Masking On Demand 11.3.0.4 - Apply IBM InfoSphere Optim Masking On Demand 11.3 iFix 12 |
| IBM InfoSphere Optim Masking On Demand | 9.1 | 11 | - Apply IBM InfoSphere Optim Masking On Demand 9.1.0.6 - Apply IBM InfoSphere Optim Masking On Demand 9.1 iFix 11 |
You can install the OMOD patches for Optim Data Privacy Application (a.k.a, ModApp) using one of two methods:
- Using the OMOD iFix that is found on FixCentral.
- Follow the instructions in this Technote to use IBM Installation Manger to directly download the iFix from IBM and apply it. This method requires an external internet connection on the host machine containing Installation Manager and the Optim Data Privacy Application.
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Change History
23 December 2016: Original version published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
08 July 2021
UID
swg21993435