Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in ICU

Vulnerability Details

CVEID: CVE-2017-7868
DESCRIPTION: International Components for Unicode (ICU) is vulnerable to a heap-based buffer overflow, caused by a flaw in the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function. By using a specially-crafted uloc_getDisplayName call, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause a denial of service.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/124609 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2017-7867
DESCRIPTION: International Components for Unicode (ICU) is vulnerable to a heap-based buffer overflow, caused by a flaw in the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function. By using a specially-crafted uloc_getDisplayName call, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause a denial of service.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/124610 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2017-17484
DESCRIPTION: International Components for Unicode (ICU) for C/C++ is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the ucnv_UTF8FromUTF8 function in ucnv_u8.cpp. By sending a specially-crafted request, a remote attacker could overflow a buffer and cause the application to crash.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/136202 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2017-15422
DESCRIPTION: Google Chrome could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in ICU. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service.
CVSS Base Score: 6.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/136054 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)