CVE-2015-0132: High severity ibm rational requirements composer vulnerability
The XML parser in IBM Rational DOORS Next Generation 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 and Rational Requirements Composer 2.x and 3.x before 3.0.1.6 iFix5 and 4.x before 4.0.7 iFix3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0132?
CVE-2015-0132 has a moderate severity rating, as it can lead to denial of service due to improper detection of recursion in the XML parser.
How do I fix CVE-2015-0132?
To fix CVE-2015-0132, upgrade IBM Rational DOORS Next Generation or Rational Requirements Composer to the latest versions mentioned in the vulnerability report.
Which versions are affected by CVE-2015-0132?
CVE-2015-0132 affects IBM Rational DOORS Next Generation versions before 4.0.7 and 5.0.1, as well as Rational Requirements Composer versions before 4.0.7 iFix3.
Can CVE-2015-0132 be exploited remotely?
Yes, CVE-2015-0132 can be exploited by remote attackers which could lead to denial of service.
What systems are impacted by CVE-2015-0132?
CVE-2015-0132 impacts multiple versions of IBM Rational DOORS Next Generation and IBM Rational Requirements Composer across its various releases.