IBM API Connect has addressed the following vulnerabilities. PHP is vulnerable to a denial of service, caused by a NULL pointer dereference in ext/ldap/ldap.c. By sending specially crafted data, an attacker could exploit this vulnerability to mishandle the ldap_get_dn return value and cause a denial of service. PHP is vulnerable to a denial of service, caused by the failure to reject invalid multibyte sequences by the iconv stream filter in ext/iconv/iconv.c. An attacker could exploit this vulnerability to cause the application to enter into an infinite loop.
CVE(s): CVE-2018-10548, CVE-2018-10546
Affected product(s) and affected version(s):
Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://www.ibm.com/support/docview.wss?uid=swg22017510
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/142565
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/142567
The post IBM Security Bulletin: IBM API Connect Developer Portal is impacted by PHP vulnerabilities (CVE-2018-10548, CVE-2018-10546) appeared first on IBM PSIRT Blog.
| Affected API Connect | Affected Versions |
| IBM API Connect | 5.0.0.0-5.0.8.3 |
from IBM Product Security Incident Response Team https://ift.tt/2MYc7LI
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.