IBM Security Bulletin: IBM Connections Docs is affected by libxml2 vulnerabilty (CVE-2017-16932 CVE-2017-16931)
Dec 20, 2017 10:00 am EST
Categorized: High Severity
Share this post:
IBM Connections Docs has addressed the following vulnerability. IBM Connections Docs uses libxml2 to do document conversion. By using a percent character in a DTD name, a remote attacker could overflow a buffer and execute arbitrary code on the system. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to exhaust available memory on the system.
CVE(s): CVE-2017-16932, CVE-2017-16931
Affected product(s) and affected version(s):
| Affected IBM Connections Docs | Affected Versions |
| IBM Connections Docs | 2.0.0 |
Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/2B6gH4g
X-Force Database: http://ift.tt/2BNOTFm
X-Force Database: http://ift.tt/2B6gKNu
from IBM Product Security Incident Response Team http://ift.tt/2BNOW40