Security Bulletin: IBM i Integrated Web Application Server version 8.5 is affected by vulnerabilities CVE-2016-0359 and CVE-2016-2923.

Summary IBM i Integrated Web Application Server version 8.5 is affected by the following vulnerabilities CVE-2016-0359 and CVE-2016-2923. Vulnerability Details CVEID: CVE-2016-0359 DESCRIPTION: IBM WebSphere Application Server is vulnerable to HTTP response splitting attacks. A remote attacker...

Security Bulletin: Vulnerabilities in OpenSSH affect IBM i (CVE-2016-1907, CVE-2016-1908, CVE-2016-3115)

Summary OpenSSH vulnerabilities affect IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-3115 DESCRIPTION: OpenSSH could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied X11...

Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM i

Summary OpenSSL is used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-6302 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the failure to consider the HMAC size during validation of the ticket length by the tlsdecryptticket function ...

Security Bulletin: Multiple vulnerabilities in Samba, including Badlock, affect IBM i

Summary Samba vulnerabilities were disclosed on April 12, 2016. Samba is used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2118 DESCRIPTION: Samba could allow a remote attacker to gain elevated privileges on the system, caused by the acceptance of...

Security Bulletin: Vulnerabilities CVE-2016-5387 and CVE-2016-5388 in IBM i HTTP Server

Summary HTTP Server is supported by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-5388 DESCRIPTION: Apache Tomcat could allow a remote attacker to redirect HTTP traffic of CGI application, caused by the failure to protect applications from the presence of...

Security Bulletin: Vulnerabilities in Samba affect IBM i

Summary Security vulnerabilities in Samba affect IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-7560 DESCRIPTION: Samba could allow a remote authenticated attacker to launch a symlink attack. By creating a symbolic link to a file or directory using SMB1 UNIX...

Security Bulletin: IBM i is affected by networking BIND vulnerabilities (CVE-2016-9131, CVE-2016-9444, CVE-2016-9147, CVE-2016-9778 and CVE-2017-3135)

Summary ISC BIND is vulnerable to several security vulnerabilities. IBM i has addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2016-9778 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by the improper handling of specific queries when using the nxdomain-redirec...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM i (CVE-2016-2108, CVE-2016-2107, CVE-2016-2105, CVE-2016-2106, CVE-2016-2109, CVE-2016-2176)

Summary OpenSSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. OpenSSL is used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2108 DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM i (CVE-2016-0701, CVE-2015-3197)

Summary OpenSSL vulnerabilities affect IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-0701 DESCRIPTION: OpenSSL could allow a remote attacker to conduct man-in-the-middle attacks, caused by the use of weak Diffie-Hellman parameters based on unsafe primes tha...

Security Bulletin: Vulnerability in IBM JAVA 7 affect IBM UrbanCode Release (CVE-2016-2183)

Summary Vulnerability in IBM JAVA 7 affect IBM UrbanCode Release. Vulnerability Details IBM UrbanCode Release has addressed the following vulnerability: CVEID: CVE-2016-2183 DESCRIPTION: The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products,...

Security Bulletin: Vulnerability in OpenSSL affects Sterling Connect:Enterprise for UNIX (CVE-2016-0800).

Summary OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by Sterling Connect:Enterprise for UNIX. Sterling Connect:Enterprise for UNIX has addressed the applicable CVE, the “DROWN: Decrypting RSA with Obsolete and Weakened eNcryption" vulnerability...

EulerOS 2.0 SP3 : libXvMC (EulerOS-SA-2019-2628)

According to the version of the libXvMC package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Buffer underflow in X.org libXvMC before 1.0.10 allows remote X servers to have unspecified impact via an empty string.CVE-2016-7953 Note that...

EulerOS 2.0 SP3 : libidn (EulerOS-SA-2019-2608)

According to the versions of the libidn package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers...

EulerOS 2.0 SP3 : icu (EulerOS-SA-2019-2594)

According to the versions of the icu packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - International Components for Unicode ICU for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to t...

EulerOS 2.0 SP3 : perl (EulerOS-SA-2019-2648)

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - 1 cpan/Archive-Tar/bin/ptar, 2 cpan/Archive-Tar/bin/ptardiff, 3 cpan/Archive-Tar/bin/ptargrep, 4 cpan/CPAN/scripts/cpan, 5 cpan/Digest-SHA/shasum,...

EulerOS 2.0 SP3 : giflib (EulerOS-SA-2019-2587)

According to the versions of the giflib package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service program crash via crafted image an...

EulerOS 2.0 SP3 : tar (EulerOS-SA-2019-2673)

According to the version of the tar package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Directory traversal vulnerability in the safernamesuffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended...

EulerOS 2.0 SP3 : sqlite (EulerOS-SA-2019-2664)

According to the version of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - osunix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive...

EulerOS 2.0 SP3 : shadow-utils (EulerOS-SA-2019-2662)

According to the version of the shadow-utils package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.CVE-2016-6252 Note that Tenable Network...

EulerOS 2.0 SP3 : pcsc-lite (EulerOS-SA-2019-2647)

According to the version of the pcsc-lite packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Use-after-free vulnerability in pcsc-lite before 1.8.20 allows a remote attackers to cause denial of service crash via a command that uses...