Security Bulletin: IBM Cúram Universal Access V6.0.5.5 can be vulnerable to CRLF Injection attack (CVE-2014-3069)

Summary IBM Cúram Universal Access is vulnerable to CRLF Injection attack when not deployed on IBM WebSphere. Vulnerability Details CVE ID: CVE-2014-3069 DESCRIPTION: The Universal Access component of IBM Cúram Social Program Management, when not deployed on IBM WebSphere Application Server, is...

Oracle Linux 6 : zsh (ELSA-2018-1932)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-1932 advisory. - fix defects detected by Coverity related to CVE-2017-18206 and CVE-2018-1083 - fix stack-based buffer overflow in utils.c:checkmailpath CVE-2018-1100...

Security Bulletin: Multiple vulnerabilities in current releases of IBM® SDK, Java™ Technology Edition

Summary Java SE issues disclosed in the Oracle January 2014 Critical Patch Update Vulnerability Details CVE IDs: CVE-2014-0428 CVE-2014-0422 CVE-2013-5907 CVE-2014-0415 CVE-2014-0410 CVE-2013-5889 CVE-2014-0417 CVE-2014-0387 CVE-2014-0424 CVE-2013-5878 CVE-2014-0373 CVE-2014-0375 CVE-2014-0403...

Security Bulletin: Injection vulnerabilities in WebSphere Lombardi Edition and IBM Business Process Manager (BPM) (CVE-2014-3087)

Summary Service inputs can be passed into callService.do as URL parameters in an XML format. Because of insufficient input validation, XML injection attacks are possible. Vulnerability Details CVE ID: CVE-2014-3087 DESCRIPTION: IBM WebSphere Lombardi Edition and IBM Business Process Manager might...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM WebSphere Application Server Community Edition 3.0.0.4 related to Java Technology Edition Quarterly CPU - January 2015(CVE-2015-0383,CVE-2014-3566,CVE-2014-6593 and CVE-2015-0410)

Summary Multiple security vulnerabilities exist in IBM SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server Community 3.0.0.4. Vulnerability Details CVE-ID: CVE-2015-0383 DESCRIPTION: An unspecified vulnerability in Oracle Java SE and JRockit related to the Hotspot...

Security Bulletin: WebSphere Process Server Hypervisor Edition Bash vulnerability (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary WebSphere Process Server Hypervisor Edition might be vulnerable to CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277 and CVE-2014-6278 shellshock vulnerabilities in bash delivered by UNIX-based platforms. Vulnerability Details CVE-ID: CVE-2014-6271 DESCRIPTION: GNU...

Security Bulletin: POODLE vulnerability in SSLv3 affects IBM CICS Transaction Gateway (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. Supported versions of CICS Transaction Gateway for Mutliplatforms and CICS Transaction Gateway for Desktop Edition are affected by POODLE. Vulnerability Details CV...

CentOS 6 : zsh (CESA-2018:1932)

An update for zsh is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

USN-3686-1: file vulnerabilities | Cloud Foundry

Severity Low Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Alexander Cherepanov discovered that file incorrectly handled a large number of notes. An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. CVE-2014-9620...

SUSE-SU-2018:1743-1 Security update for dwr

This update for dwr fixes the following issues: Security issue fixed: - CVE-2014-5326: Fix cross-site scripting XSS vulnerability bsc1085650...

SUSE-SU-2018:1745-1 Security update for dwr

This update for dwr fixes the following issues: Security issue fixed: - CVE-2014-5326: Fix cross-site scripting XSS vulnerability bsc1085650...

Security Bulletin: A vulnerability in Open Source Apache Tomcat affects the IBM FlashSystem V840, (CVE-2014-0227)

Summary There is a vulnerability in Open Source Apache Tomcat that is used by the IBM FlashSystem V840 which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service under error scenarios. Vulnerability Details CVE-ID: CVE-2014-0227 Description: Apache Tomcat...

Security Bulletin: Vulnerabilities in glibc affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in the GNU C Library glibc. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2014-9761 DESCRIPTION: GNU C Library glibc is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the nan...

Security Bulletin: Vulnerabilities in git affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in git. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2017-8386 DESCRIPTION: Git could allow a remote authenticated attacker to gain elevated privileges on the system. By giving a specially crafted repository name wit...

Security Bulletin: A vulnerability in Python affects PowerKVM

Summary PowerKVM is affected by a vulnerability in Python. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2014-9365 DESCRIPTION: Python could allow a remote attacker to bypass security restrictions, caused by the failure to validate TLS certificate by the HTTP librarie...

Security Bulletin: IBM Flex System Manager (FSM) is affected by an International Components for Unicode (ICU) vulnerability (CVE-2014-9911)

Summary A security vulnerability has been identified in ICU that is embedded in IBM FSM. This bulletin addresses this issue. Vulnerability Details CVEID: CVE-2014-9911 DESCRIPTION: International Components for Unicode ICU is vulnerable to a stack-based buffer overflow, caused by a flaw in the...

Security Bulletin: A vulnerability in powerpc-utils-python affects PowerKVM (CVE-2014-8165)

Summary PowerKVM is affected by a vulnerability in powerpc-utils-python. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2014-8165 DESCRIPTION: powerpc-utils-python could allow a remote attacker to execute arbitrary code on the system, caused by the improper use of the...

Security Bulletin: Vulnerabilities in the Linux kernel affect PowerKVM

Summary PowerKVM is affected by numerous vulnerabilities in the linux kernel. These vulnerabilities are now fixed. Vulnerability Details CVEID: CVE-2013-7421 DESCRIPTION: Linux Kernel could allow a local attacker to bypass security restrictions, caused by an error in the in the Crypto API. An...

Security Bulletin: A vulnerability in NRPE affects PowerKVM (CVE-2014-2913)

Summary PowerKVM is affected by a vulnerability in the Nagios Remote Plugin Executor NRPE. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2014-2913 DESCRIPTION: Nagios Remote Plugin Executor NRPE could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: A vulnerability in icu affects IBM Flex System Manager (FSM) (CVE-2014-9654)

Summary A security vulnerability has been discovered in icu that is embedded in the IBM FSM. This bulletin addresses this vulnerability. Vulnerability Details CVEID: CVE-2014-9654 DESCRIPTION: ICU could allow a remote attacker to execute arbitrary code on the system, caused by improper size limit...