Security Bulletin: IBM Prospect is affected by Expat XML Parser vulnerability (CVE-2019-15903)

Summary

Prospect Server is affected by Expat XML parsing vulnarability CVE-2019-15903 which may result in a heap-based buffer over-read.

Vulnerability Details

CVEID:CVE-2019-15903
**DESCRIPTION:**In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/166560 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

A hotfix is available to update the Expat libraries to version 2.2.8. The hotfix also provides updated loader binaries as they are built using the static expat library.

Download the hotfix from below locations:

IBM Prospect 8.0.7.13 : https://testcase.boulder.ibm.com/fromibm/8.0.7.13_HF07

IBM Prospect R42.2 : <sftp://hjsftp.persistent.co.in/R421HF04>

Workarounds and Mitigations

None