Multiple vulnerabilities in IBM Java SDK affect AIX

IBM SECURITY ADVISORY First Issued: Tue Jun 14 14:37:05 CDT 2022 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/javajun2022advisory.asc https://aix.software.ibm.com/aix/efixes/security/javajun2022advisory.asc...

AIX is vulnerable to a denial of service due to lpd

IBM SECURITY ADVISORY First Issued: Tue Jun 14 14:27:45 CDT 2022 |Updated: Tue Sep 13 13:16:19 CDT 2022 |Update: Added iFix information for 7.1 TL5 SP10 and 7.2 TL4 SP6. The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/lpdadvisory2.asc...

CVE-2022-22444

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a local user to exploit a vulnerability in the lpd daemon to cause a denial of service. IBM X-Force ID: 224444...

Mounting SMB Share During AIX Bare Metal Restore Results in Inaccessible Data on Restored Machine

Challenge After mounting a CIFS/SMB mount in the Bare Metal Restore environment, data on some VG aren't accessible in the restored system. Cause This issue occurs because affected VG's major device number in /dev doesn't match information within ODM. Detailed Cause: Before a CIFS/SMB share can be...

Security Bulletin: Multiple vulnerabbilities exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Configuration Manager

Summary Multiple vulnerabilities exists in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Configuration Manager IP Edition v6.4.2, which was disclosed in the Oracle January 2022 Critical Patch Update. CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-2134...

Security Bulletin: A vulnerabbility exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Configuration Manager (CVE-2021-35550).

Summary A vulnerability exists in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Configuration Manager IP Edition v6.4.2, which was disclosed in the Oracle October 2021 Critical Patch Update. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: A vulnerabbility exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Manager (CVE-2021-35550).

Summary A vulnerability exists in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Manager IP Edition v4.2, which was disclosed in the Oracle October 2021 Critical Patch Update. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: Multiple vulnerabilities exist in the IBM® SDK, Java™ Technology Edition affecting IBM Tivoli Network Manager

Summary Multiple vulnerabilities exist in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Manager IP Edition v4.2, which was disclosed in the Oracle January 2022 Critical Patch Update. CVE-2022-21365, CVE-2022-21360, CVE-2022-21349, CVE-2022-21341, CVE-2022-21340...

Security Bulletin: Vulnerability in OpenSSH affects AIX (CVE-2021-41617)

Summary There is a vulnerability in OpenSSH used by AIX. Vulnerability Details CVEID: CVE-2021-41617 DESCRIPTION: OpenSSH could allow a local attacker to gain elevated privileges on the system, caused by an error in sshd when certain non-default configurations are used. By executing an...

Security Bulletin: Vulnerability in mount affects AIX (CVE-2021-38990)

Summary There is a vulnerability in the mount command that affects AIX. Vulnerability Details CVEID:CVE-2021-38990 DESCRIPTION: IBM AIX could allow a non-privileged local user to exploit a vulnerability in the mount command which could lead to code execution. CVSS Base score: 8.4 CVSS Temporal...

Oracle Linux 8 : kernel (ELSA-2022-1988)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1988 advisory. - netfilter: nftablesoffload: incorrect flow offload action array size Florian Westphal 2056728 CVE-2022-25636 - RDMA/cma: Do not change...

Security Bulletin: AIX is vulnerable to a denial of service due to OpenSSL (CVE-2022-0778)

Summary A vulnerability in OpenSSL could allow a remote attacker to cause a denial of service CVE-2022-0778. OpenSSL is used by AIX as part of AIX's secure network communications. Vulnerability Details CVEID:CVE-2022-0778 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw...

AIX is vulnerable to a denial of service due to OpenSSL

IBM SECURITY ADVISORY First Issued: Fri May 13 09:32:08 CDT 2022 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/openssladvisory35.asc https://aix.software.ibm.com/aix/efixes/security/openssladvisory35.asc...

AlmaLinux 8 : kernel (ALSA-2022:1988)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:1988 advisory. - In uvcscanchainforward of uvcdriver.c, there is a possible linked list corruption due to an unusual root cause. This could lead to local escalation of...

IBM Java 8.0 < 8.0.5.30

The version of IBM Java installed on the remote host is prior to 8.0 8.0.5.30. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update March 2019 advisory. - IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate cod...

IBM Java 7.0 < 7.0.10.50 / 7.1 < 7.1.4.50 / 8.0 < 8.0.5.40 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is prior to 7.0 7.0.10.50 / 7.1 7.1.4.50 / 8.0 8.0.5.40. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Update July 2019 advisory. - Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on...

Security Bulletin: Vulnerabilities in the AIX kernel (CVE-2021-38994, CVE-2021-38995)

Summary There are multiple vulnerabilities in the AIX kernel. Vulnerability Details CVEID: CVE-2021-38995 DESCRIPTION: IBM AIX could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. CVSS Base score: 6.2 CVSS Temporal Score: See:...

Security Bulletin: Vulnerability in AIX nimsh (CVE-2022-22351)

Summary UPDATED Mar 24 See Change History: There is a vulnerability in the AIX nimsh daemon. Vulnerability Details CVEID: CVE-2022-22351 DESCRIPTION: IBM AIX could allow a non-privileged trusted host user to exploit a vulnerability in the nimsh daemon to cause a denial of service in the nimsh...

Security Bulletin: Lodash versions prior to 4.17.21 vulnerability in PowerHA System Mirror for AIX

Summary Lodash versions prior to 4.17.21 caused vulnerability in PowerHA System Mirror for AIX releases in service. Vulnerability Details CVEID: CVE-2021-23337 DESCRIPTION: Node.js lodash module could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by a...

IBM AIX Input Validation Error Vulnerability

IBM AIX is an open standards-based UNIX operating system developed by IBM for the IBM Power architecture. IBM AIX has an input validation error vulnerability, which stems from a problem with CAA/Kernel and can be exploited by an attacker to trigger a denial of service...