Security Bulletin: Vulnerability in libc affects AIX (CVE-2021-29860)

Summary UPDATED Mar 17 Corrected the affected upper fileset levels for AIX 7.1 TL5 to show that SP11 is affected. Added iFix for 7.1 TL5 SP11 There is a vulnerability in the libc.a library that affects AIX. Vulnerability Details CVEID:CVE-2021-29860 DESCRIPTION: IBM AIX could allow a non-privileg...

Security Bulletin: Vulnerabilites in OpenSSL may affect IBM Spectrum Protect Backup-Archive Client (CVE-2022-4450, CVE-2023-0216, CVE-2023-0401, CVE-2022-4203, CVE-2023-0217)

Summary IBM Spectrum Protect Backup-Archive Client can be affected by vulnerabilities in OpenSSL. Vulnerabilities include disclosure of sensitive information and denial of service, as described by the CVEs in the "Vulnerability Details" section. Vulnerability Details CVEID:CVE-2022-4450...

Security Bulletin: AIX is vulnerable to a denial of service due to lpd (CVE-2022-43382)

Summary UPDATED Mar 17 Corrected the affected upper fileset levels for AIX 7.1 TL5 to show that SP11 is affected. Corrected the affected upper fileset levels for AIX 7.3 TL0 to show that SP03 is affected. Added iFixes for 7.1 TL5 SP10 and 7.3 TL0 SP03. A vulnerability in the AIX lpd printer daemo...

Security Bulletin: Vulnerability in Java SE may affect IBM Spectrum Protect Operations Center (CVE-2022-21626)

Summary IBM Spectrum Protect Operations Center may be affected by vulnerabilityies in Java SE such as denial of service attack, as described by the CVEs in the "Vulnerability Details" section. Vulnerability Details CVEID:CVE-2022-21626 DESCRIPTION: An unspecified vulnerability in Java SE related ...

Security Bulletin: AIX is affected by a denial of service (CVE-2022-45061) due to Python

Summary A vulnerability in Python could allow a remote attacker to cause a denial of service CVE-2022-45061. Python is used by AIX as part of Ansible node management automation. Vulnerability Details CVEID:CVE-2022-45061 DESCRIPTION: Python is vulnerable to a denial of service, caused by an...

AIX is affected by a denial of service due to Python

IBM SECURITY ADVISORY First Issued: Tue Mar 14 13:01:15 CDT 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/pythonadvisory4.asc Security Bulletin: AIX is affected by a denial of service CVE-2022-45061 due to Python...

Security Bulletin: server-side request forgery vulnerability in Apache CXF (CVE-2022-46364) may affect TXSeries for Multiplatforms

Summary TXSeries for Multiplatforms has addressed a vulnerability in Apache CXF CVE-2022-46364. Vulnerability Details CVEID:CVE-2022-46364 DESCRIPTION: Apache CXF is vulnerable to server-side request forgery, caused by a flaw in parsing the href attribute of XOP:Include in MTOM requests. By using...

SUSE CVE-2006-3083

The 1 krshd and 2 v4rcp applications in a MIT Kerberos 5 krb5 up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and b Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which allows local users to gain privileges by causing setuid to fail to drop privileges usi...

SUSE CVE-2018-1890

IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081...

SUSE CVE-2019-11771

AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users...

SUSE CVE-2019-17041

An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter in this case, a space or a colon but fails to account for strings that do not satisfy this...

SUSE CVE-2020-4788

IBM Power9 AIX 7.1, 7.2, and VIOS 3.1 processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296...

IBM AIX Kernel Code Execution

The vulnerability of the IBM AIX operating system’s kernel is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain superuser privileges and execute arbitrary code...

Security Bulletin: IBM Sterling Connect:Direct for UNIX is vulnerable to denial of servce due to IBM Java (CVE-2022-21626)

Summary IBM Java is used by IBM Sterling Connect:Direct for UNIX on AIX, Linux, and Solaris platforms in product configuration, management, and data transmission. IBM Sterling Connect:Direct for UNIX on AIX, Linux, and Solaris platforms is impacted by a denial of service issue in IBM Java...

Security Bulletin: Vulnerability (CVE-2022-3676) in Eclipse Openj9 affects CICS Transaction Gateway Desktop Edition

Summary Eclipse Openj9 is used by CICS Transaction Gateway Desktop Edition. The fix removes vulnerability CVE-2022-3676 that could allow a remote attacker to bypass security restrictions. Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass...

AIX is vulnerable to arbitrary code execution due to libxml2 (CVE-2022-40303 and CVE-2022-40304)

IBM SECURITY ADVISORY First Issued: Wed Feb 8 13:18:47 CST 2023 |Updated: Thu May 4 13:36:14 CDT 2023 |Update: Corrected the affected upper fileset levels for AIX 7.2 TL5 to | show that SP06 is affected. Corrected the affected upper fileset | levels for AIX 7.3 TL1 to show that SP02 is affected...

Security Bulletin: IBM Sterling Connect:Direct File Agent is vulnerable to a memory exploit due to Eclipse Openj9 (CVE-2022-3676)

Summary There is a vulnerability in Eclipse Openj9 used by IBM Sterling Connect:Direct File Agent. IBM Sterling Connect:Direct File Agent has addressed the applicable issue. Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security...

Security Bulletin: IBM Sterling Connect:Direct File Agent is vulnerable to a denial of service due to IBM Runtime Environment Java Technology Edition (CVE-2022-21626)

Summary There is a vulnerability in IBM Runtime Environment Java Technology Edition, Version 7 and 8 used by IBM Sterling Connect:Direct File Agent. IBM Sterling Connect:Direct File Agent has addressed the issue. Vulnerability Details CVEID:CVE-2022-21626 DESCRIPTION: An unspecified vulnerability...

IBM AIX has an unspecified vulnerability (CNVD-2023-05472)

IBM AIX is an open standards-based UNIX operating system developed by International Business Machines IBM for the IBM Power architecture. IBM AIX has a security vulnerability that stems from a buffer overflow caused by a non-privileged local user exploiting a vulnerability in X11, resulting in a...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect AIX

Summary Vulnerabilities in OpenSSL could allow a remote attacker to cause a buffer overflow CVE-2022-3602, cause a denial of service CVE-2022-3786, or obtain sensitive information CVE-2022-3358. OpenSSL is used by AIX as part of AIX's secure network communications. Vulnerability Details...