Security Bulletin: IBM MQ Appliance is affected by libxslt vulnerabilities (CVE-2019-11068, CVE-2019-18197)

2021-03-0316:05:04

www.ibm.com

ibm mq appliance

libxslt

vulnerabilities

apar it35457

9.1 lts

9.1 cd

9.2 lts

9.2 cd

EPSS

0.013

Percentile

86.1%

JSON

Summary

IBM MQ Appliance has resolved libxslt vulnerabilities.

Vulnerability Details

CVEID:CVE-2019-11068
**DESCRIPTION:**libxslt could allow a remote attacker to bypass security restrictions, caused by a flaw in the xsltCheckRead and xsltCheckWrite routines. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass access restrictions.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/159898 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2019-18197
**DESCRIPTION:**libxslt is vulnerable to a denial of service, caused by a use-after-free flaw in the xsltCopyText function function in transform.c. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition or obtain uninitialized data.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/169684 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)