Security Bulletin: Vulnerabilities in Expat component shipped with IBM Rational ClearQuest (CVE-2016-0718, CVE-2015-1283, CVE-2016-4472, CVE-2015-2716)

Summary

IBM Rational ClearQuest is affected by Expat library buffer overflow and denial of service vulnerabilities.

Vulnerability Details

CVEID: CVE-2016-0718**
DESCRIPTION:** Expat is vulnerable to a buffer overflow, caused by improper bounds checking when processing malformed XML data. By using the Expat library, a remote attacker could overflow a buffer and execute arbitrary code on the system with the privileges of the victim or cause the application to crash.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/113408 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID: CVE-2015-1283**
DESCRIPTION:** Expat, as used in Google Chrome, is vulnerable to a heap-based buffer overflow, caused by multiple integer overflows in the XML_GetBuffer function. By persuading a victim to open a specially crafted XML file, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 6.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/104964 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)

CVEID: CVE-2016-4472**
DESCRIPTION:** Expat XML parser is vulnerable to a denial of service, caused by the removal by compilers with certain optimization settings. By using a specially-crafted XML data, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114683 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2015-2716**
DESCRIPTION:** Expat, as used in Mozilla Firefox and Thunderbird, is vulnerable to a buffer overflow, caused by improper bounds checking by the XML parser. By persuading a victim to open a specially crafted XML file, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 6.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/103214 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P)

Affected Products and Versions

Rational ClearQuest 7.1 through 7.1.2.19, 8.0 through 8.0.0.20, 8.0.1 through 8.0.1.13, and 9.0 through 9.0.0.3.

Remediation/Fixes

Apply a fixpack for your appropriate release of IBM Rational ClearQuest:

Affected version

|

Fixes

—|—

9.0 through 9.0.0.3

| Install Rational ClearQuest Fix Pack 4 (9.0.0.4) for 9.0

8.0.1 through 8.0.1.13

| Install Rational ClearQuest Fix Pack 14 (8.0.1.14) for 8.0.1

8.0 through 8.0.0.20

| Install Rational ClearQuest Fix Pack 21 (8.0.0.21) for 8.0

7.1 through 7.1.2.19

| Customers on extended support contracts for 7.1 should contact Customer Support for information.
For 7.0 and 7.1 and earlier releases, IBM recommends upgrading to a fixed, supported version/release/platform of the product.

Workarounds and Mitigations

None