Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in ICU

Summary

IBM Flex System Chassis Management Module (CMM) has addressed the following vulnerabilities in ICU.

Vulnerability Details

CVEID: CVE-2017-7868 DESCRIPTION: International Components for Unicode (ICU) is vulnerable to a heap-based buffer overflow, caused by a flaw in the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function. By using a specially-crafted uloc_getDisplayName call, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause a denial of service.
CVSS Base Score: 7.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/124609&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2017-7867 DESCRIPTION: International Components for Unicode (ICU) is vulnerable to a heap-based buffer overflow, caused by a flaw in the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function. By using a specially-crafted uloc_getDisplayName call, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause a denial of service.
CVSS Base Score: 7.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/124610&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2017-17484 DESCRIPTION: International Components for Unicode (ICU) for C/C++ is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the ucnv_UTF8FromUTF8 function in ucnv_u8.cpp. By sending a specially-crafted request, a remote attacker could overflow a buffer and cause the application to crash.
CVSS Base Score: 7.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/136202&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2017-15422 DESCRIPTION: Google Chrome could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in ICU. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service.
CVSS Base Score: 6.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/136054&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)

Affected Products and Versions

Product

|

Affected Version

—|—

IBM Flex System Chassis Management Module (CMM)

|

2PET

Remediation/Fixes

Firmware fix versions are available on Fix Central: <http://www.ibm.com/support/fixcentral/&gt;

Product

|

Fix Version

—|—

IBM Flex System Chassis Management Module (CMM)
(ibm_fw_cmm_2pet16d-2.5.13d_anyos_noarch)

|

2pet16d-2.5.13d

Workarounds and Mitigations

None