IT15089: VULNERABILITIES IN THE XML PROCESSING COMPONENT OF SOME IBM DATAPOWER GATEWAYS INTERNAL SERVICES. (MULTIPLE CVES)

Fix packs for DataPower Gateway version 7.2

APAR status

• Closed as program error.

Error description

• Vulnerabilities in the XML processing component of some IBM
  DataPower Gateways internal services. (CVE-2015-5312
  CVE-2015-7497 CVE-2015-7498
  CVE-2015-7499 CVE-2015-7500 CVE-2015-7941 CVE-2015-7942
  CVE-2015-8241 CVE-2015-8242 CVE-2015-8317)
  The XML processing component of some IBM DataPower gateways
  internal services is affected by a variety of vulnerabilities
  that can cause
  a denial of service when presented with specially crafted data.
  

Local fix

Problem summary

• Multiple CVEs (CVE-2015-5312 CVE-2015-7497 CVE-2015-7498
  CVE-2015-7499 CVE-2015-7500 CVE-2015-7941 CVE-2015-7942
  CVE-2015-8241 CVE-2015-8242 CVE-2015-8317) concern
  vulnerabilities in the processing of XML files for some internal
  services
  which can cause a
   denial of service.  IBM DataPower Gateways versions 7.2.0.0 to
  7.2.0.5 are affected by these CVEs.
  

Problem conclusion

• Fix is available in 7.2.0.6 and 7.5.0.0
  
  For a list of the latest fix packs available, please see:
  http://www-01.ibm.com/support/docview.wss?uid=swg21237631
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DATAPOWER

• Fixed component ID

  DP1234567

Applicable component levels

• R720 PSY

     UP

• R750 PSY

     UP