Security Bulletin: IBM API Connect is impacted by multiple vulnerabilities in PHP (CVE-2019-11045, CVE-2019-11044, CVE-2019-11046)

Vulnerability Details

CVEID:   CVE-2019-11045
DESCRIPTION:   PHP could allow a remote attacker to bypass security restrictions, caused by an issue when DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. By using a specially-crafted filename, an attacker could exploit this vulnerability to bypass applications checking paths for the code is allowed to access.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/173633 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID:   CVE-2019-11044
DESCRIPTION:   PHP could allow a remote attacker to bypass security restrictions, caused by an issue when link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. By using a specially-crafted filename, an attacker could exploit this vulnerability to bypass applications checking paths for the code is allowed to access.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/173632 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVEID:   CVE-2019-11046
DESCRIPTION:   PHP could allow a remote attacker to obtain sensitive information, caused by improper input validation by the bcmath extension functions. By using a specially-crafted string containing characters that are numeric but not ASCII numbers, an attacker could exploit this vulnerability to obtain content of some memory locations, and use this information to launch further attacks against the affected system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/173634 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)