Security Bulletin: IBM Analytics Engine in Cloud pak for Data affected by vulnerability in GNOME's GdkPixbuf library (CVE-2022-48622)

2024-08-0108:18:40

www.ibm.com

ibm analytics engine

cloud pak for data

vulnerability

gnome's gdkpixbuf library

cve-2022-48622

heap memory corruption

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

JSON

Summary

IBM Analytics Engine in Cloud pak for Data contains a vulnerable version of GNOME’s GdkPixbuf library.

Vulnerability Details

CVEID:CVE-2022-48622
**DESCRIPTION:**GNOME GdkPixbuf could allow a remote attacker to execute arbitrary code on the system, caused by a heap memory corruption in the ani_load_chunk function in io-ani.c. By persuading a victim to open a specially crafted .ani file, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/281182 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Analytics Engine Cloud Pak for Data	4.8.x - 5.0

Remediation/Fixes

Upgrade to IBM Analytics Engine CP4D versions 5.0.1 or higher - <https://www.ibm.com/docs/en/cloud-paks/cp-data/5.0.x?topic=upgrading>

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmwatson_assistant_for_ibm_cloud_pak_for_dataMatch4.8.

VendorProductVersionCPE
ibmwatson_assistant_for_ibm_cloud_pak_for_data4.8.cpe:2.3:a:ibm:watson_assistant_for_ibm_cloud_pak_for_data:4.8.:*:*:*:*:*:*:*