Multiple vulnerabilities fixed in IBM Spectrum Protect

🗓️ 13 Dec 2021 00:00:00Reported by NCSCType

ncsc

ncsc🔗 advisories.ncsc.nl👁 48 Views

IBM fixes vulnerabilities in Spectrum Protect and bundled software, including remote execution.

Reporter	Title	Published	Views	Family All 7038
zdt	Linux TIOCSPGRP Broken Locking Exploit	24 Dec 202000:00	–	zdt
zdt	nginx 1.20.0 DNS Resolver Off-By-One Heap Write Exploit	27 May 202100:00	–	zdt
zdt	Linux Kernel 2.6.19 < 5.9 - (Netfilter) Local Privilege Escalation Exploit	16 Jul 202100:00	–	zdt
zdt	Netfilter x_tables Heap Out-Of-Bounds Write / Privilege Escalation Exploit	7 Oct 202100:00	–	zdt
zdt	Nginx 1.20.0 - Denial of Service Exploit	11 Jul 202200:00	–	zdt
zdt	VMware NSX Manager XStream Unauthenticated Remote Code Execution Exploit	16 Nov 202200:00	–	zdt
vulnersOsv	com.comcast.money:money-kafka_2.13 (>=0.9.1 <=0.15.1), com.consol.citrus:citrus-kafka (>=3.0.0-M2 <=3.0.0-M3) +57 more potentially affected by CVE-2021-38153 via org.apache.kafka:kafka_2.13 (>=2.4.0 <=2.6.2)	23 Sep 202123:18	–	vulnersosv
vulnersOsv	ai.hyacinth.framework:core-service-admin-server (>=0.5.0 <=0.5.24), ai.hyacinth.framework:core-service-discovery-server (>=0.5.0 <=0.5.24) +6134 more potentially affected by CVE-2021-39153 via com.thoughtworks.xstream:xstream (>=1.1.1 <=1.4.17)	25 Aug 202114:46	–	vulnersosv
vulnersOsv	ai.chronon:online_2.13 (>=0.0.25 <=revert-391-thread-0.0.24), ai.chronon:service_2.13 (>=0.0.86 <=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91) +1025 more potentially affected by CVE-2021-38153 via org.apache.kafka:kafka-clients (=2.8.0)	13 Aug 202110:23	–	vulnersosv
vulnersOsv	ai.hyacinth.framework:core-service-admin-server (>=0.5.0 <=0.5.24), ai.hyacinth.framework:core-service-discovery-server (>=0.5.0 <=0.5.24) +6134 more potentially affected by CVE-2021-39139 via com.thoughtworks.xstream:xstream (>=1.1.1 <=1.4.17)	25 Aug 202114:48	–	vulnersosv

13 Dec 2021 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 27.5

CVSS 3.18.5 - 9.8

CVSS 37.5

EPSS0.98124

SSVC

Spectrum Protect Bundled software Denial of service Data manipulation Circumvention of security Remote code execution Data access Privilege escalation