Security Bulletin
Summary
Multiple libarchive vulnerabilities affect Watson Explorer.
Vulnerability Details
CVEID: CVE-2016-8688
DESCRIPTION: libarchive is vulnerable to a denial of service, caused by an an invalid read error in the detect_form or bid_entry function in libarchive/archive_read_support_format_mtree.c. By persuading a victim to open a specially crafted file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/122105 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVEID: CVE-2016-8689
DESCRIPTION: libarchive is vulnerable to a denial of service, caused by an out-of-bounds read error in the read_Header function in archive_read_support_format_7zip.c. By persuading a victim to open a specially crafted archive file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/122106 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVEID: CVE-2017-5601
DESCRIPTION: libarchive is vulnerable to a denial of service, caused by an out-of-bounds memory access error in the lha_read_file_header_1() function. By persuading a victim to open a specially crafted archive file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/121360 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVEID: CVE-2016-10209
DESCRIPTION: libarchive is vulnerable to a denial of service, caused by a NULL pointer dereference in archive_wstring_append_from_mbs function in archive_string.c. By persuading a victim to read a specially crafted archive file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 3.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/127053 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVEID: CVE-2016-10350
DESCRIPTION: libarchive is vulnerable to a denial of service, caused by a heap-based buffer over-read in the archive_read_format_cab_read_header function in archive_read_support_format_cab. By persuading a victim to open a specially crafted file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 6.2
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/126671 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2016-10349
DESCRIPTION: libarchive is vulnerable to a denial of service, caused by a flaw in the archive_le32dec function in archive_endian.h. By persuading a victim to open a specially crafted file, a remote attacker could exploit this vulnerability to cause a heap-based buffer over-read which leads to an application crash.
CVSS Base Score: 6.2
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/126670 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
These vulnerabilities apply to the following products and versions:
- Watson Explorer Foundational Components version 10.0.0.4 and earlier.
- Watson Explorer Foundational Components version 11.0.0.3 and earlier, version 11.0.1, version 11.0.2.
Remediation/Fixes
Follow these steps to upgrade to the required version of libarchive. The table reflects product names at the time the specified versions were released. To use the link to Fix Central in this table, you must first log in to the IBM Support: Fix Central site at http://www.ibm.com/support/fixcentral/.
| Affected Product | Affected Versions | How to acquire and apply the fix |
|---|---|---|
| IBM Watson Explorer Foundational Components | 11.0 - 11.0.0.3, 11.0.1, 11.0.2 |
Upgrade to Version 11.0.2.1. See Watson Explorer Version 11.0.2.1 Foundational Components for download information and instructions. |
| IBM Watson Explorer Foundational Components | 10.0 - 10.0.0.4 |
Upgrade to 10.0.0.5. See Watson Explorer Version 10.0.0.5 Foundational Components for download information and instructions. |
Get Notified about Future Security Bulletins
References
Change History
22 Aug 2018 : Added Version 10 information
7 Aug 2017 : Original version published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Internal Use Only
| Date | Notes |
|---|---|
| 22 Aug 2018 | Added Version 10 information (Deviation approved by Sep.30.2018) |
| 7 Aug 2017 | Original version published |
Was this topic helpful?
Document Information
Modified date:
22 August 2018
UID
swg22006995