Vulernabilities

[Former Member]

Is there a version of the crystal reports runtime installer that addresses the following vulnerabilities:

• 1.Vulnerabilities exist because CRRuntime installs IIS to the root of C:\. This is considered a high vulnerability.
• This can be found in the following locations within the application:
• C:\inetpub
• 2.Vulnerabilities exist because CRRuntime installs an unknown version of libcurl which may contain vulnerabilities according to the following Common Vulnerabilities datastore link:
• https://www.cvedetails.com/vulnerability-list/vendor_id-12682/product_id-25085/Haxx-Libcurl.html

• This can be found in the following location within the application: c:\program files (x86)\sap businessobjects\crystal reports for .net framework 4.0\common\sap businessobjects enterprise xi 4.0\win32_x86\libcurl.dll
• 3.Vulnerabilities exist because CRRuntime installs libssh2 version 1.4.3 which contain vulnerabilities according to the following Common Vulnerabilities datastore link:

https://www.cvedetails.com/vulnerability-list/vendor_id-15300/product_id-31293/Libssh2-Libssh2.html

• This can be found in the following location within the application:c:\program files (x86)\sap businessobjects\crystal reports for .net framework 4.0\common\sap businessobjects enterprise xi 4.0\win32_x86\libssh2.dll

4.Vulnerabilities exist because CRRuntime installs openssl version 1.0.2h which contain vulnerabilities according to the following Common Vulnerabilities datastore link:

https://www.cvedetails.com/vulnerability-list/vendor_id-217/product_id-383/Openssl-Openssl.html

• This can be found in the following location within the application: c:\program files (x86)\sap businessobjects\crystal reports for .net framework 4.0\common\sap businessobjects enterprise xi 4.0\win32_x86\ssleaym32.dll

5.Vulnerabilities exist because Arena Simulation version 16.x installs xercex version 3.1.4 which contain vulnerabilities according to the following Common Vulnerabilities datastore link:

https://www.cvedetails.com/vulnerability-list/vendor_id-45/product_id-31348/Apache-Xerces-c.html

• This can be found in the following location within the application: c:\program files (x86)\sap businessobjects\crystal reports for .net framework 4.0\common\sap businessobjects enterprise xi 4.0\win32_x86\xerces-c_3_1.dll