Security Bulletin: Multiple vulnerabilities in Network Time Protocol (NTP) affect PowerKVM

Summary PowerKVM is affected by several vulnerabilities in Network Time Protocol NTP. These vulnerabilities are now fixed. Vulnerability Details CVEID: CVE-2014-9297 DESCRIPTION: Network Time Protocol NTP Project NTP daemon ntpd could allow a remote attacker to conduct spoofing attacks, caused by...

Security Bulletin: Vulnerability in netcf affects PowerKVM (CVE-2014-8119)

Summary PowerKVM is affected by a vulnerability in netcf. This vulnerability is now fixed. Vulnerability Details CVEID: CVE-2014-8119 DESCRIPTION: The netcfg package in Linux is vulnerable to a denial of service, caused by the improper processing of XPath expressions by the findifcfgpath function...

Security Bulletin: Vulnerabilities in MIT Kerberos 5 (krb5) affect PowerKVM (CVE-2014-5355, CVE-2015-2694)

Summary PowerKVM is affected by two vulnerabilities in MIT Kerberos 5 krb5. These vulnerabilities are now fixed. Vulnerability Details CVEID: CVE-2014-5355 DESCRIPTION: MIT Kerberos is vulnerable to a denial of service, caused by a NULL pointer dereference in the krb5recvauth function. By sending...

Security Bulletin: Multiple vulnerabilities in curl affect PowerKVM

Summary PowerKVM is affected by several vulnerabilities in curl. These vulnerabilities are now fixed. Vulnerability Details CVEID: CVE-2014-3613 DESCRIPTION: cURL/libcURL could allow a remote attacker to bypass security restrictions, caused by the failure to properly detect and reject domain name...

Security Bulletin: Vulnerability in cpio affects PowerKVM (CVE-2014-9112)

Summary A vulnerability in GNU cpio CVE-2014-9112 affects PowerKVM. Vulnerability Details CVEID: CVE-2014-9112 DESCRIPTION: GNU cpio is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the processcopyin function. By persuading a victim to extract a specially-craft...

Security Bulletin: IBM Pure Power Integrated Manager (PPIM) is affected by vulnerabilities in ntp (CVE-2014-9750, CVE-2014-9751)

Summary Security vulnerabilities have been discovered in ntp embedded in the IBM PPIM. This bulletin addresses these issues. Vulnerability Details CVEID: CVE-2014-9750 DESCRIPTION: NTP NTPd could allow a remote attacker to obtain sensitive information, caused by an error in ntpcrypto.c when Autok...

Security Bulletin: Multiple Vulnerabilities in OpenSSL including Logjam affect IBM Flex System Manager (FSM)

Summary OpenSSL vulnerabilities were disclosed on June 11, 2015 by the OpenSSL Project. This includes Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol CVE-2015-4000. OpenSSL is used by FSM. FSM has addressed the applicable CVEs. Vulnerability Details CVEID:...

Security Bulletin: Vulnerabilities in the GNU C Libraries (glibc) affect IBM Flex System Manager(FSM) (CVE-2013-2207, CVE-2014-8121, CVE-2015-1781)

Summary Multiple security vulnerabilities have been discovered in the GNU C Library glibc that is embedded in the IBM FSM. These vulnerabilities are addressed in this bulletin. Vulnerability Details CVEID: CVE-2013-2207 DESCRIPTION: The GNU C Library glibc could allow a local attacker to bypass...

Security Bulletin: A security vulnerability with net-snmp affects IBM Flex System Manager (CVE-2015-3565)

Summary A security vulnerability has been identified in net-snmp that is used by IBM Flex System Manager FSM. This bulletin addresses this vulnerability. Vulnerability Details CVEID: CVE-2014-3565 DESCRIPTION: Net-SNMP is vulnerable to a denial of service, caused by the improper handling of SNMP...

Security Bulletin: Vulnerabilities in Python affect PowerKVM (CVE-2013-5123, CVE-2014-8991)

Summary PowerKVM is affected by two vulnerabilities in Python. These vulnerabilities are now fixed. Vulnerability Details CVEID: CVE-2013-5123 DESCRIPTION: Python pip could allow a remote attacker to bypass security restrictions, caused by the implementation of the mirroring support without...

Security Bulletin: PowerKVM is affected by Linux Kernel vulnerabilities (multiple CVEs)

Summary PowerKVM is affected by several Linux Kernel vulnerabilities multiple CVEs . Vulnerability Details CVEID: CVE-2015-2041 DESCRIPTION: Linux Kernel could allow a local attacker to obtain sensitive information, caused by an information leak in llc2timeouttable. An attacker could exploit this...

Security Bulletin: PowerKVM is affected by cups vulnerabilities (multiple CVEs)

Summary PowerKVM is affected by cups vulnerabilities multiple CVEs. Vulnerability Details CVEID: CVE-2014-9679 DESCRIPTION: CUPS is vulnerable to a buffer overflow, caused by an integer overflow in cupsRasterReadPixels. By persuading a victim to open a specially-crafted raster file, a remote...

Security Bulletin: PowerKVM is affected by a qemu vulnerability (CVE-2014-9718)

Summary PowerKVM is affected by a qemu vulnerability. Vulnerability Details CVEID: CVE-2014-9718 DESCRIPTION: QEMU is vulnerable to a denial of service, caused by the failure to restrict malicious PRDT data from flowing from a guest to the host's IDE or AHCI controllers. A remote attacker could...

Security Bulletin: PowerKVM is affected by glibc vulnerabilities (Multiple CVEs)

Summary PowerKVM is affected by multiple glibc vulnerabilities. Vulnerability Details CVEID: CVE-2014-6040 DESCRIPTION: The GNU C Library glibc is vulnerable to a denial of service, caused by the improper validation of input by the iconv function when converting IBM933, IBM935, IBM937, IBM939 or...

Security Bulletin: PowerKVM is affected by ppc64-diag and powerpc-utils vulnerabilities (Multiple CVEs)

Summary PowerKVM is affected by multiple vulnerabilities in ppc64-diag and powerpc-utils. Vulnerability Details CVEID: CVE-2014-4038 DESCRIPTION: ppc64-diag could allow a local attacker to launch a symlink attack. lpdelatest.sh creates temporary files insecurely. A local attacker could exploit th...

Security Bulletin: PowerKVM is affected by a libxml2 vulnerability (CVE-2014-0191)

Summary PowerKVM is affected by libxml vulnerability CVE-2014-0191. Vulnerability Details CVEID: CVE-2014-0191 DESCRIPTION: Libxml2 is vulnerable to a denial of service, caused by the expansion of internal entities within the xmlParserHandlePEReference function. A remote attacker could exploit th...

Security Bulletin: Multiple Unzip vulnerabilities affect PowerKVM (Multiple CVEs)

Summary PowerKVM is affected by several vulnerabilities in OpenSSL. Vulnerability Details CVEID: CVE-2014-8139 DESCRIPTION: Info-ZIP UnZip is vulnerable to a heap-based buffer overflow, caused by improper bounds checking within the CRC32 verification. A lo CVSS Base Score: 4.4 CVSS Temporal Score...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM SDN-VE (CVE-2014-3570, CVE- 2014-3571, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204, CVE-2015-0205, CVE-2015-0206)

Summary Security vulnerablities have been discovered in OpenSSL Vulnerability Details CVEID:CVE-2014-3570 DESCRIPTION: An unspecified error in OpenSSL related to the production of incorrect results on some platforms by Bignum squaring BNsqr has an unknown attack vector and impact. CVSS Base Score...

Security Bulletin: Vulnerability in SSLv3 affects IBM Platform Symphony (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in Platform Symphony. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...

Security Bulletin: Vulnerabilities in Bash affect IBM SDN VE (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory corruption vulnerabilities. Bash is used by IBM SDN VE. Vulnerability Details CVE-ID: CVE-2014-6271 DESCRIPTION: G...