Out-of-bounds read in LibSass - CVE-2018-11698

Vulnerability identifier: #VU76610

CSH Severity: High

CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-11698

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the function Sass::handle_error. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.

LibSass
IBM Watson Machine Learning Accelerator
IBM Planning Analytics Workspace
IBM Security Verify Information Queue
IBM Edge Application Manager
IBM Watson Machine Learning on CP4D
QRadar User Behavior Analytics
IBM QRadar Data Synchronization App

Install updates from vendor's website.

LibSass - update to 3.5.5
IBM Planning Analytics Workspace - update to 2.0.93
IBM Watson Machine Learning on CP4D - update to 2.6.0
IBM QRadar Data Synchronization App - update to 3.2.1
QRadar User Behavior Analytics - update to 4.1.11
IBM Security Verify Information Queue - update to 10.0.0

• https://github.com/sass/libsass/issues/2662

• Multiple vulnerabilities in IBM Security Verify Information Queue
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• Multiple vulnerabilities in IBM QRadar Data Synchronization App