Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM9F3B15A9AE7651159C837CFA956A8CC8AD21BC8222D78C6F0BBC6EACD0C01634
HistoryOct 18, 2019 - 3:10 a.m.

Security Bulletin: Multiple Vulnerabilities in Open Source zlib affect IBM Netezza SQL Extensions

2019-10-1803:10:29
www.ibm.com
5

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

Summary

Open Source zlib is used by IBM Netezza SQL Extensions. IBM Netezza SQL Extensions has addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2016-9840**
DESCRIPTION:** zlib is vulnerable to a denial of service, caused by an out-of-bounds pointer arithmetic in inftrees.c. By persuading a victim to open a specially crafted document, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base Score: 3.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/120508&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-9841**
DESCRIPTION:** zlib is vulnerable to a denial of service, caused by an out-of-bounds pointer arithmetic in inftrees.c. By persuading a victim to open a specially crafted document, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base Score: 3.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/120509&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-9842**
DESCRIPTION:** zlib is vulnerable to a denial of service, caused by an undefined left shift of negative number. By persuading a victim to open a specially crafted document, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base Score: 3.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/120510&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-9843**
DESCRIPTION:** zlib is vulnerable to a denial of service, caused by a big-endian out-of-bounds pointer. By persuading a victim to open a specially crafted document, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base Score: 3.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/120511&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

Affected Products and Versions

  • IBM Netezza SQL Extensions 1.5.0.0 - 7.2.1.3

Remediation/Fixes

To resolve the reported CVEs for IBM Netezza SQL Extensions, please upgrade to the following version:

Product VRMF Remediation/First Fix
IBM Netezza SQL Extensions 7.2.1.4 Link to Fix Central

Workarounds and Mitigations

None

CPENameOperatorVersion
ibm puredata systemeq1.0.0

Related

nessus 54
ibm 76
openvas 11
cloudfoundry 2
freebsd 1
osv 11
ubuntu 3
gentoo 2
mageia 1
debian 2
thn 1
photon 1
redhat 4
suse 4
aix 1
debiancve 4
veracode 4
prion 4
alpinelinux 4
cve 4
ubuntucve 4
mariadbunix 1
nessus
nessus
SUSE SLED12 / SLES12 Security Update : zlib (SUSE-SU-2017:0003-1)
2017-01-03 00:00:00
openSUSE Security Update : zlib (openSUSE-2016-1499)
2016-12-21 00:00:00
SUSE SLED12 / SLES12 Security Update : zlib (SUSE-SU-2017:0004-1)
2017-01-03 00:00:00
ibm
ibm
Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime IBM affect IBM Decision Optimization Center and IBM ILOG ODM Enterprise
2018-06-16 13:48:03
Security Bulletin: zlib vulnerability may affect IBM® SDK, Java™ Technology Edition
2018-06-16 13:48:22
Security Bulletin: IBM® Db2® is affected by vulnerabilities in the IBM® SDK, Java Technology Edition Quarterly Critical Patch Updates (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843)
2018-06-16 14:17:49
openvas
openvas
Huawei EulerOS: Security Advisory for zlib (EulerOS-SA-2019-2704)
2020-01-23 00:00:00
Huawei EulerOS: Security Advisory for zlib (EulerOS-SA-2019-1276)
2020-01-23 00:00:00
Debian LTS: Security Advisory for zlib (DLA-2085-1)
2020-01-30 00:00:00
cloudfoundry
cloudfoundry
USN-4292-1: rsync vulnerabilities | Cloud Foundry
2020-03-10 00:00:00
USN-4246-1: zlib vulnerabilities | Cloud Foundry
2020-02-12 00:00:00
freebsd
freebsd
net/rsync -- multiple zlib issues
2020-06-19 00:00:00
osv
osv
zlib - security update
2020-01-29 00:00:00
rsync - security update
2019-03-24 00:00:00
klibc vulnerabilities
2024-04-16 11:43:39
ubuntu
ubuntu
zlib vulnerabilities
2020-01-22 00:00:00
rsync vulnerabilities
2020-02-25 00:00:00
klibc vulnerabilities
2024-04-16 00:00:00
gentoo
gentoo
zlib: Multiple vulnerabilities
2017-01-23 00:00:00
rsync: Multiple vulnerabilities
2020-07-28 00:00:00
mageia
mageia
Updated rsync packages fix security vulnerabilities
2020-02-29 16:42:35
debian
debian
[SECURITY] [DLA 2085-1] zlib security update
2020-01-29 21:52:33
[SECURITY] [DLA 1725-1] rsync security update
2019-03-24 21:48:25
thn
thn
Dozens of Vulnerable NuGet Packages Allow Attackers to Target .NET Platform
2021-07-07 12:58:00
photon
photon
Critical Photon OS Security Update - PHSA-2017-0051
2017-06-22 00:00:00
redhat
redhat
(RHSA-2017:1222) Moderate: java-1.6.0-ibm security update
2017-05-10 12:23:26
(RHSA-2017:1220) Moderate: java-1.8.0-ibm security update
2017-05-10 12:22:51
(RHSA-2017:1221) Moderate: java-1.7.1-ibm security update
2017-05-10 12:23:11
suse
suse
Security update for java-1_8_0-ibm (important)
2017-05-23 21:14:04
Security update for java-1_7_1-ibm (important)
2017-05-23 21:14:27
Security update for java-1_7_0-ibm (important)
2017-05-23 21:13:05
aix
aix
There are multiple vulnerabilities in IBM SDK Java Technology Edition
2017-06-21 15:44:57
debiancve
debiancve
CVE-2016-9842
2017-05-23 04:29:00
CVE-2016-9840
2017-05-23 04:29:00
CVE-2016-9841
2017-05-23 04:29:00
veracode
veracode
Denial Of Service (DoS)
2019-05-02 06:11:09
Arbitrary Code Execution
2019-01-15 09:17:08
Denial Of Service (DoS)
2019-05-02 06:11:09
prion
prion
Design/Logic Flaw
2017-05-23 04:29:00
Null pointer dereference
2017-05-23 04:29:00
Null pointer dereference
2017-05-23 04:29:00
alpinelinux
alpinelinux
CVE-2016-9842
2017-05-23 04:29:00
CVE-2016-9843
2017-05-23 04:29:00
CVE-2016-9840
2017-05-23 04:29:00
cve
cve
CVE-2016-9840
2017-05-23 04:29:00
CVE-2016-9842
2017-05-23 04:29:00
CVE-2016-9841
2017-05-23 04:29:00
ubuntucve
ubuntucve
CVE-2016-9840
2017-05-23 00:00:00
CVE-2016-9842
2017-05-23 00:00:00
CVE-2016-9841
2017-05-23 00:00:00
mariadbunix
mariadbunix
CVE-2016-9843
2017-05-23 04:29:01

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON
Related for 9F3B15A9AE7651159C837CFA956A8CC8AD21BC8222D78C6F0BBC6EACD0C01634
nessus54ibm76openvas11cloudfoundry2freebsd1osv11ubuntu3gentoo2mageia1debian2thn1photon1redhat4suse4aix1debiancve4veracode4prion4alpinelinux4cve4ubuntucve4mariadbunix1