Security Bulletin
Summary
Multiple vulnerabilities exist in PCRE v5.x, shipped with IBM Tivoli Network Manager IP Edition. Therefore PCRE 8.35 has been upgraded in IBM Tivoli Network Manager IP Edition.
Vulnerability Details
CVE-ID: CVE-2015-2327
Description: PCRE is vulnerable to a denial of service, caused by the improper handling of patterns with certain recursion. A remote attacker could exploit this vulnerability using a specially crafted regular expression to cause a segmentation fault.
CVSS Base Score: 5.300
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/109275 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVE-ID: CVE-2015-2328
Description: PCRE is vulnerable to a denial of service, caused by the improper handling of patterns with certain internal recursive back references. A remote attacker could exploit this vulnerability using a specially crafted regular expression to cause a segmentation fault.
CVSS Base Score: 5.300
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/109276 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Affected Products and Versions
|
AffectedProduct | VRMF | APAR | Remediation/First Fix |
| Tivoli Network Manager IP Edition | 3.8.0.7 | IV81816 | Fix to be deliver on demand Please call IBM service and reference APAR IV81816, to obtain a fix. |
| Tivoli Network Manager IP Edition | 3.9.0.4/IF01 | IV81816 | https://www-01.ibm.com/support/docview.wss?uid=swg24037809 |
| Tivoli Network Manager IP Edition | 4.1 | IV81816 | Fix to be deliver on demand Please call IBM service and reference APAR IV81816, to obtain a fix. |
| Tivoli Network Manager IP Edition | 4.1.1.1 | IV81816 | Interim Fix to be release on or before Oct 29th. |
| Tivoli Network Manager IP Edition | 4.2 | IV81816 | PCRE has been upgraded in 42 FP1.http://www-01.ibm.com/support/docview.wss?uid=swg24042425 |
Remediation/Fixes
29 Oct 2016: Original document published
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
17 June 2018
UID
swg21990632