Security Bulletin
Summary
IBM Rational ClearCase is affected by Expat library buffer overflow and denial of service vulnerabilities.
Vulnerability Details
CVEID: CVE-2016-0718
DESCRIPTION: Expat is vulnerable to a buffer overflow, caused by improper bounds checking when processing malformed XML data. By using the Expat library, a remote attacker could overflow a buffer and execute arbitrary code on the system with the privileges of the victim or cause the application to crash.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/113408 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2015-1283
DESCRIPTION: Expat, as used in Google Chrome, is vulnerable to a heap-based buffer overflow, caused by multiple integer overflows in the XML_GetBuffer function. By persuading a victim to open a specially crafted XML file, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 6.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/104964 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
CVEID: CVE-2016-4472
DESCRIPTION: Expat XML parser is vulnerable to a denial of service, caused by the removal by compilers with certain optimization settings. By using a specially-crafted XML data, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114683 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2015-2716
DESCRIPTION: Expat, as used in Mozilla Firefox and Thunderbird, is vulnerable to a buffer overflow, caused by improper bounds checking by the XML parser. By persuading a victim to open a specially crafted XML file, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/103214 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Affected Products and Versions
The Expat component is used in the ClearCase full client, in the xmldiffmerge and clearmrgman graphical interfaces.
ClearCase client version | Status |
9.0 through 9.0.0.3 | Affected |
8.0.1 through 8.0.1.13 | Affected |
8.0 through 8.0.0.20 | Affected |
7.1 through 7.1.2.19 (all releases and fix packs) | Affected |
Remediation/Fixes
The solution is to upgrade to a fix pack of ClearCase that has a fix in the Expat component.
Affected Versions | Applying the fix |
9.0 through 9.0.0.3 | Install Rational ClearCase Fix Pack 4 (9.0.0.4) for 9.0 |
8.0.1 through 8.0.1.13 | Install Rational ClearCase Fix Pack 14 (8.0.1.14) for 8.0.1 |
8.0 through 8.0.0.20 | Install Rational ClearCase Fix Pack 21 (8.0.0.21) for 8.0 |
7.1 through 7.1.2.19 (all releases and fix packs) | Customers on extended support contracts should contact Customer Support for information. |
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
Important Note
IBM strongly suggests that all System z customers be subscribed to the System z Security Portal to receive the latest critical System z security and integrity service. If you are not subscribed, see the instructions on the System z Security web site. Security and integrity APARs and associated fixes will be posted to this portal. IBM suggests reviewing the CVSS scores and applying all security or integrity fixes as soon as possible to minimize any potential risk.
References
Change History
15 March 2017: Original copy published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
10 July 2018
UID
swg21998042