The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document that triggers expansion for many entities.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ibm Aix | — | Apply the fix or workaround for java_advisory | Nov 30, 2017 | Oct 19, 2013 |
| Suse | — | Upgrade java-1_5_0-ibm-devel-32bitUpgrade java-1_7_0-ibmUpgrade java-1_5_0-ibm-jdbcUpgrade java-1_6_0-ibm-alsaUpgrade java-1_6_0-ibm-32bitUpgrade java-1_6_0-ibm-devel-32bitUpgrade java-1_6_0-ibm-plugin-32bitUpgrade java-1_6_0-ibm-alsa-32bitUpgrade java-1_5_0-ibm-pluginUpgrade java-1_5_0-ibmUpgrade java-1_5_0-ibm-alsa-32bitUpgrade java-1_6_0-ibm-jdbcUpgrade java-1_6_0-ibmUpgrade java-1_6_0-ibm-develUpgrade java-1_7_0-ibm-develUpgrade java-1_7_0-ibm-pluginUpgrade sle-sdk-releaseUpgrade java-1_6_0-ibm-pluginUpgrade java-1_7_0-ibm-alsaUpgrade java-1_7_0-ibm-jdbcUpgrade java-1_5_0-ibm-32bitUpgrade java-1_6_0-ibm-fontsUpgrade java-1_5_0-ibm-develUpgrade java-1_5_0-ibm-fontsUpgrade java-1_5_0-ibm-alsa | Feb 17, 2015 | Oct 19, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub