Security Bulletin: Vulnerability in zlib affect OS Image for AIX Systems shipped with IBM Cloud Pak System [CVE-2018-25032]

Summary

Vulnerability in zlib affect OS Image for AIX Systems shipped with IBM Cloud Pak System.

Vulnerability Details

CVEID:CVE-2018-25032
**DESCRIPTION:**Zlib is vulnerable to a denial of service, caused by a memory corruption in the deflate operation. By using many distant matches, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/222615 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

Vulnerability in zlib affect OS image for AIX System. In reposne to this vulnerability IBM provides new IBM Cloud Pak System v2.3.3.7 Interim Fix 1 that update OS Image for AIX System to OS Image AIX 3.1.2.0 with AIX 7.2 TL5 SP6.

For Cloud Pak System V2.3.1.1, V2.3.2.0 for Power
Upgrade to Cloud Pak System v2.3.3.7 and apply V2.3.3.7 Interim Fix 01 at IBM Fix Central.
information on upgrading here <https://www.ibm.com/support/pages/node/6982511&gt;

For Cloud Pak System V2.3.3.7 for Power
Apply Cloud Pak System V2.3.3.7 Interim Fix 01 at IBM Fix Central.

information on upgrading available at <http://www.ibm.com/support/docview.wss?uid=ibm10887959&gt;

Workarounds and Mitigations

None