Security Bulletin: IBM Db2 Mirror for i is affected by CVE-2019-4536

Summary IBM Db2 Mirror for i configurations may be subject to this security vulnerability. A PTF for IBM i 7.4 and remediation steps are available. Vulnerability Details CVEID: CVE-2019-4536 DESCRIPTION: IBM i 7.4 users who have done a Restore User Profile RSTUSRPRF on a system which has been...

Security Bulletin: Vulnerability CVE-2019-1559 in OpenSSL affects IBM i

Summary OpenSSL is used by IBM i. IBM i has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-1559 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after the hosts encounter a...

Security Bulletin: Vulnerability CVE-2019-1543 in OpenSSL affects IBM i

Summary OpenSSL is used by IBM i. IBM i has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-1543 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the ChaCha20-Poly1305 AEAD cipher. By sending a message encrypted using a...

Security Bulletin: Multiple vulnerabilities in the IBM SDK Java™ Technology for IBM i

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition for IBM i. These issues were disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details CVEID: CVE-2014-3086 DESCRIPTION: A vulnerability in the IBM implementation of the Java Virtual Machine ma...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM i

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered with this product, you should evaluat...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM i (CVE-2016-2177 and CVE-2016-2178)

Summary OpenSSL is used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2177 DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in codebase. An attacker could exploit this vulnerability...

Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM i

Summary OpenSSL is used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-0739 DESCRIPTION: OpenSSL is vulnerable to a denial of service. By sending specially crafted ASN.1 data with a recursive definition, a remote attacker could exploit this vulnerability ...

Security Bulletin: Vulnerability in OSPFv2 Routing Protocol Used in IBM i Operating System (CVE-2013-0149 and CVE-2013-5385)

Problem : The OSPFv2 routing protocol specified in RFC 2328 has an ambiguity that can be exploited and allow for traffic to be black-holed and/or redirected. A PTF is provided. Resolving The Problem VULNERABILITY DETAILS: DESCRIPTION: A potential protocol vulnerability has been identified in the...

Security Bulletin: Multiple Vulnerabilities in OpenSSH affect IBM i

Summary OpenSSH is used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-10009 DESCRIPTION: OpenSSH could allow a remote authenticated attacker to execute arbitrary code on the system, caused by the loading of a specially crafted PKCS11 module across a...

Security Bulletin: IBM i is affected by CVE-2018-20685, CVE-2019-6111, and CVE-2019-6109 vulnerabilities in OpenSSH.

Summary OpenSSH is used by IBM i. IBM i has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2019-6109 DESCRIPTION: OpenSSH could allow a remote attacker to conduct spoofing attacks, caused by missing character encoding in the progress display. A man-in-the-middle attacke...

Security Bulletin: Vulnerability CVE-2017-9798 in the IBM i HTTP Server affects IBM i.

Summary HTTP Server is supported by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-9798 DESCRIPTION: Apache HTTP Server could allow a remote attacker to obtain sensitive information, caused by a flaw in the HTTP OPTIONS method, aka Optionsbleed. By sending a...

Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect IBM i

Summary OpenSSL vulnerabilities were disclosed on June 11, 2015 by the OpenSSL Project. This includes Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol CVE-2015-4000. OpenSSL is used by IBM i and IBM i has addressed the applicable CVEs. Vulnerability Details CVEID...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM i

Summary OpenSSL vulnerabilities were disclosed on December 3, 2015 by the OpenSSL Project. OpenSSL is used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-3193 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM i

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered with this product, you should evaluat...

Security Bulletin: Vulnerability in Apache Commons affects IBM i (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by IBM i. Vulnerability Details CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the system, caused by the...

Security Bulletin: IBM Navigator for i is affected by CVE-2019-4040

Summary IBM Navigator for i is supported by IBM i. IBM i has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-4040 DESCRIPTION: IBM Navigator for i is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus...

Security Bulletin: Vulnerability CVE-2017-2619 in Samba affects IBM i

Summary Samba is supported on IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-2619 DESCRIPTION: Samba could allow a remote authenticated attacker to launch a symlink attack, caused by a race condition A local attacker could exploit this vulnerability using SM...

Security Bulletin: IBM i Access for Windows affected by vulnerability CVE-2016-0287.

Summary IBM i Access for Windows is affected by vulnerability CVE-2016-0287. This vulnerability affects the Windows system running the IBM i Access for Windows product. Vulnerability Details CVEID: CVE-2016-0287 DESCRIPTION: IBM i Access for Windows could allow a local privileged user to obtain t...

Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM i

Summary OpenSSL is used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-6302 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the failure to consider the HMAC size during validation of the ticket length by the tlsdecryptticket function ...

Security Bulletin: IBM i is affected by networking BIND vulnerabilities (CVE-2016-2775, CVE-2016-2776, CVE-2016-8864 and CVE-2016-6170)

Summary ISC BIND is vulnerable to several security vulnerabilities. IBM i has addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2016-2775 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by an error when lwresd or the named lwres option is enabled. By sending an...