Vulnerability Description
The XML parser in IBM Rational DOORS Next Generation 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 and Rational Requirements Composer 2.x and 3.x before 3.0.1.6 iFix5 and 4.x before 4.0.7 iFix3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Rational Requirements Composer | 2.0 |
| Ibm | Rational Doors Next Generation | 4.0.0 |
Related Weaknesses (CWE)
References
- http://www-01.ibm.com/support/docview.wss?uid=swg21698248PatchVendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21698248PatchVendor Advisory
FAQ
What is CVE-2015-0132?
CVE-2015-0132 is a vulnerability with a CVSS score of 7.8 (HIGH). The XML parser in IBM Rational DOORS Next Generation 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 and Rational Requirements Composer 2.x and 3.x before 3.0.1.6 iFix5 and 4.x before 4.0.7 iFix3 does not...
How severe is CVE-2015-0132?
CVE-2015-0132 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-0132?
Check the references section above for vendor advisories and patch information. Affected products include: Ibm Rational Requirements Composer, Ibm Rational Doors Next Generation.