CVE-2016-6059 XML external entity in InfoSphere Information Server

What is CVE-2016-6059?

CVE-2016-6059 is a high-severity vulnerability in Ibm Infosphere Information Server, published on 1 Feb 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources.

Weakness: CWE-611

Which versions are affected by CVE-2016-6059?

It affects 3 products.

Products include Ibm Infosphere Datastage, Ibm Infosphere Information Server, Ibm Infosphere Information Server on Cloud.

How do I fix CVE-2016-6059?

No fix has been published for CVE-2016-6059 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-6059 being exploited?

There is no known exploitation of CVE-2016-6059 in the wild and no public exploit code.

Other vulnerabilities in Ibm Infosphere Information Server

• CVE-2015-1900 Privilege escalation in n/a High 7.2
• CVE-2011-3123 Privilege escalation in n/a High 7.2
• CVE-2011-3124 Privilege escalation in n/a High 7.2
• CVE-2012-0701 Missing authorization in n/a Medium 6.5
• CVE-2016-9000 Cross-site scripting in InfoSphere Information Server Medium 6.1

All Ibm Infosphere Information Server vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fjjf-46hr-qcp6.