Updated to include the additional sites for CentOS and Ubuntu.
IBM BigFix Patch has released Fixlets to address the Stack Clash Vulnerabilities for CVE 2017-1000364, CVE 2017-1000366, and CVE-2017-1000367.
The Fixlets for these CVEs are released in the following sites:
- Patches for Oracle Linux 6 site, version 50
- Patches for Oracle Linux 7 site, version 82
- Patches for RHEL 6 - Native Tools site, version 332
- Patches for RHEL RHSM 6 on System Z site, version 38
- Patches for RHEL 7 site, version 165
- Patches for RHEL RHSM 7 on System Z site, version 26
- Patches for RHEL 7 for IBM Power LE site, version 35
- Patches for RHEL 7 for IBM Power BE site, version 5
- Patches for SLE 11 Native Tools site, version 196
- Patches for SLE 11 on System z Native Tools site, version 26
- Patches for SLE 12 Native Tools site, version 140
- Patches for CentOS6 R2 site, version 11
- Patches for CentOS7 R2 site, version 10
- Patches for Ubuntu 1401 site, version 206
- Patches for Ubuntu 1601 site, version 46
NOTE: BigFix is unable to publish the Fixlets for some operating systems because the vendors have not published the patches for these CVEs yet. BigFix will publish the Fixlets for these operating systems as soon as the patches become available:
- SUSE Linux Enterprise Desktop 11: CVE 2017-1000364, CVE 2017-1000366, and CVE-2017-1000367
- SUSE Linux Enterprise Server 11z: CVE-2017-1000367
Actions to Take:
Given the serious nature of these vulnerabilities, it is advisable to upgrade your systems immediately or apply the patch as soon as possible.
No other action is required after applying the Fixlets.
Additional Information:
For more information, see the following sources:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000364
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000366
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000367
Application Engineering team
IBM BigFix Patch