Security Bulletin: Vulnerability in ICU4C affects IBM Tealeaf Customer Experience (CVE-2016-6293)

Summary

IBM Tealeaf Customer Experience uses a version of ICU4C with a reported security issue.

Vulnerability Details

CVEID: CVE-2016-6293**
DESCRIPTION:** International Components for Unicode (ICU) could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds read in the uloc_acceptLanguageFromHTTP function. An attacker could exploit this vulnerability using a call with a long httpAcceptLanguage argument to execute arbitrary code on the system. Note: This vulnerability also affect PHP.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/115536 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

IBM Tealeaf Customer Experience 9.0.1-9.0.2

Remediation/Fixes

Product

|

VRMF

|

Remediation/First Fix

—|—|—

IBM Tealeaf Customer Experience

|

9.0.2A

| http://www.ibm.com/support/fixcentral/swg/quickorder?parent=Enterprise%20Marketing%20Management&product=ibm/Other+software/Tealeaf+Customer+Experience&release=All&platform=All&function=fixId&fixids=9.0.2.5269_9.0.2A_IBMTealeaf_CXUpgrade_FixPack5&includeRequisites=1&includeSupersedes=0&downloadMethod=http&source=fc

IBM Tealeaf Customer Experience

|

9.0.2

| http://www.ibm.com/support/fixcentral/swg/quickorder?parent=Enterprise%20Marketing%20Management&product=ibm/Other+software/Tealeaf+Customer+Experience&release=All&platform=All&function=fixId&fixids=9.0.2.1283_IBMTealeaf_CXUpgrade_FixPack5&includeRequisites=1&includeSupersedes=0&downloadMethod=http&source=fc

IBM Tealeaf Customer Experience

|

9.0.1A

| http://www.ibm.com/support/fixcentral/swg/quickorder?parent=Enterprise%20Marketing%20Management&product=ibm/Other+software/Tealeaf+Customer+Experience&release=All&platform=All&function=fixId&fixids=9.0.1.5118_9.0.1A_IBMTealeaf_CXUpgrade_FixPack6&includeRequisites=1&includeSupersedes=0&downloadMethod=http&source=fc

IBM Tealeaf Customer Experience

|

9.0.1

| http://www.ibm.com/support/fixcentral/swg/quickorder?parent=Enterprise%20Marketing%20Management&product=ibm/Other+software/Tealeaf+Customer+Experience&release=All&platform=All&function=fixId&fixids=9.0.1.1128_9.0.1_IBMTealeaf_CXUpgrade_FixPack6&includeRequisites=1&includeSupersedes=0&downloadMethod=http&source=fc

Workarounds and Mitigations

None