IBM37C10C2D0E7D2BFB4BB1A32B884A646EE86AC573C6ABC320C9FB60A8F1A3ECB6Security Bulletin: XL compilers on AIX are vulnerable to denial of service due to zlib and zlibNX (CVE-2018-25032)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.003 Low
EPSS
Percentile
67.9%
Summary
A vulnerability in zlib and zlibNX could allow a remote attacker to cause a denial of service (CVE-2018-25032). XL compilers on AIX use zlib and zlibNX as part of its data compression functions.
Vulnerability Details
Refer to the security bulletin(s) listed in the Remediation/Fixes section
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|
Open XL C/C++/Fortran for AIX
| V17.1.1
XL C/C++/Fortran for AIX
| V16.1.0
Remediation/Fixes
XL compilers on AIX are making use of the AIX OS supplied zlib libraries. Please see <https://www.ibm.com/support/pages/node/6824891/> for remediation/fixes.
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| xl fortran for aix | eq | 17.1.1 | |
| xl fortran for aix | eq | 16.1.0 | |
| xl c/c++ for aix | eq | 17.1.1 | |
| xl c/c++ for aix | eq | 16.1.0 |
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.003 Low
EPSS
Percentile
67.9%