SB2022110410 - Multiple vulnerabilities in IBM App Connect Enterprise Certified Container

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022110410

SB2022110410 - Multiple vulnerabilities in IBM App Connect Enterprise Certified Container

Published: November 4, 2022

Security Bulletin ID SB2022110410
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Out-of-bounds write (CVE-ID: CVE-2017-0663)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.


2) XXE attack (CVE-ID: CVE-2017-7375)

The vulnerability allows a remote unauthenticated attacker to perform XXE attack on the target system.

The weakness exists in the xmlParsePEReference function due to insufficient validation for external entities. A remote attacker can perform XXE attack and gain access to potentially sensitive information.

Remediation

Install update from vendor's website.

References