CVE-2016-6059: XEE

Published Feb 1, 2017

Updated

IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources.

Affected Software

7 affected components

IBM InfoSphere DataStage=11.3

IBM InfoSphere DataStage=11.3.1

IBM InfoSphere DataStage=11.5

IBM InfoSphere Information Server=11.3

IBM InfoSphere Information Server=11.3.1

IBM InfoSphere Information Server=11.5

IBM Infosphere Information Server On Cloud=11.5

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg21991683

Event History

Feb 1, 2017

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionWeakness

Data Sourced

via NVD·08:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2016-6059?

CVE-2016-6059 is classified as a high severity vulnerability due to its potential for denial of service and data exposure.

How do I fix CVE-2016-6059?

To fix CVE-2016-6059, ensure that you apply the latest security patches provided by IBM for affected versions of InfoSphere.

Which versions of IBM InfoSphere are affected by CVE-2016-6059?

CVE-2016-6059 affects IBM InfoSphere DataStage and Information Server versions 11.3, 11.3.1, and 11.5.

Can CVE-2016-6059 lead to data exposure?

Yes, CVE-2016-6059 can allow a remote attacker to expose sensitive information through XML External Entity Injection.

What type of attack exploits CVE-2016-6059?

CVE-2016-6059 can be exploited through an XML External Entity Injection (XXE) attack.