Security Bulletin: Vulnerabilities in OpenSSL affect Integrated Management Module 2 (IMM2) (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568)

Summary OpenSSL vulnerabilities along with SSL 3 Fallback protection TLSFALLBACKSCSV were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by Integrated Management Module 2. Integrated Management Module 2 has addressed the applicable CVEs and included the SSL 3.0 Fallback...

Security Bulletin: Vulnerabilities affect IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware (CVE-2014-9564, CVE-2014-9565)

Summary IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware is affected by carriage return line feed injection and cross site request forgery vulnerabilities. Vulnerability Details Summary IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware is...

Security Bulletin: Vulnerability in glibc affects Integrated Management Module 2 (IMM2) (CVE-2013-4332)

Summary Vulnerability in glibc affects Integrated Management Module 2 IMM2. Vulnerability Details Summary Vulnerability in glibc affects Integrated Management Module 2 IMM2. Vulnerability Details: CVE-ID: CVE-2013-4332 Description: The GNU C Library glibc could allow a remote attacker to execute...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect MegaRAID Storage Manager (CVE-2014-3505, CVE-2014-3506, CVE-2014-3507, CVE-2014-3510, CVE-2014-3567)

Summary There are multiple vulnerabilities in OpenSSL that is used by MegaRAID Storage Manager. OpenSSL vulnerabilities along with SSL 3 Fallback protection TLSFALLBACKSCSV were disclosed on October 15, 2014 and on August 6, 2014 by the OpenSSL Project. OpenSSL is used by MegaRAID Storage Manager...

Security Bulletin: Vulnerabilities in OpenSSL affect Flex System FC3171 8Gb SAN Switch and Flex System FC3171 8Gb SAN Pass-thru (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568)

Summary OpenSSL vulnerabilities along with SSL 3 Fallback protection TLSFALLBACKSCSV were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by Flex System FC3171 8Gb SAN Switch and Flex System FC3171 8Gb SAN Pass-thru. Flex System FC31718Gb SAN Switch and Flex System FC3171 8G...

Security Bulletin: Vulnerabilities in OpenSSL affect NeXtScale n1200 Enclosure Fan Power Controller (FPC) (CVE-2014-3567)

Summary OpenSSL vulnerabilities along with SSL 3 Fallback protection TLSFALLBACKSCSV were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by Fan Power Controller. Fan Power Controller has addressed the applicable CVEs and included the SSL 3.0 Fallback protection...

Security Bulletin: Vulnerabilities in OpenSSL affect BladeCenter Switches (CVE-2014-3570, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes "FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by BladeCenter Switches. The BladeCenter Switches listedbelow have addressed the applicable...

Security Bulletin: IBM BladeCenter Advanced Management Module is affected by PHP vulnerability (CVE-2014-3669)

Summary Security vulnerability in PHP affects IBM BladeCenter Advanced Management Module. Vulnerability Details Summary Security vulnerability in PHP affects IBM BladeCenter Advanced Management Module. Vulnerability Details: CVE-ID: CVE-2014-3669 Description: PHP is vulnerable to a denial of...

Security Bulletin: Vulnerability in RC4 stream cipher affects System x Integrated Management Module (IMM) (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects System x IMM. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects System x IMM. Vulnerability Details CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow...

Security Bulletin: IBM Systems Director (ISD) is affected by vulnerability in the Console Login Window (CVE-2013-5423)

Summary IBM Systems Director is affected by a vulnerability in the Console Login Window CVE-2013-5423. Vulnerability Details Abstract IBM Systems Director is affected by a vulnerability in the Console Login Window CVE-2013-5423. Content Vulnerability Details: CVE-ID: CVE-2013-5423 Description: Th...

Security Bulletin: IBM Systems Director Storage Control is affected by vulnerabilities in OpenSSL (CVE-2014-0224 and CVE-2014-3470)

Summary Security vulnerabilities have been discovered in OpenSSL Vulnerability Details Abstract Security vulnerabilities have been discovered in OpenSSL Content Vulnerability Details: CVE-ID: CVE-2014-0224 Description: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak...

Security Bulletin: IBM Flex System Integrated Management Module II (IMM2) is affected by the following OpenSSL vulnerability: CVE-2014-0224

Summary An interface on the IBM BladeCenter Advanced Management Module AMM may expose user account names and passwords that have been configured on that AMM. Vulnerability Details Abstract Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL...

Security Bulletin: Public disclosed GNU glibc vulnerabilities used by IBM OS Images for RedHat Linux in IBM PureApplication Systems (CVE-2017-16997 CVE-2018-1000001)

Summary There are public disclosed vulnerabilities from GNU glibc that are used by the OS Images for IBM PureApplication System. To address the vulnerabilities in response to CVE-2017-16997 and CVE-2018-1000001, IBM has released Version 2.2.5.3 for IBM PureApplication System, which includes IBM O...

Security Bulletin: Account specific information likely to be present in Service Advisor data (FFDC) on the Integrated Management Module II (IMM2) (CVE-2014-0882)

Summary Account specific information may be present in Service Advisor data FFDC on IMM2. Vulnerability Details Abstract Account specific information may be present in Service Advisor data FFDC on IMM2. Content Vulnerability Details: CVE ID: CVE-2014-0882 Description: There are certain...

Security Bulletin: Vulnerabilities in OpenSSL affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in OpenSSL. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a malicious server duri...

Security Bulletin: Vulnerabilities in Ghostscript affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in Artifex Ghostscript. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2018-16542 DESCRIPTION: Artifex Ghostscript is vulnerable to a denial of service, caused by an improper interpreter stack-size checking. By...

Security Bulletin: A vulnerability in OpenSLP affects PowerKVM

Summary PowerKVM is affected by a vulnerability in OpenSLP. IBM has now addressed this vulnerability. Vulnerability Details Relevant CVE Information: CVEID: CVE-2017-17833 DESCRIPTION: OpenSLP, as used in multiple products, is vulnerable to a denial of service. A remote attacker could exploit thi...

Security Bulletin: Vulnerabilities in JasPer affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in JasPer. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2017-1000050 DESCRIPTION: JasPer is vulnerable to a denial of service, caused by a NULL pointer exception in the jp2encode function. By sending a...

Security Bulletin: A vulnerability in setup affects PowerKVM

Summary PowerKVM is affected by a vulnerability in the setup project package. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2018-1113 DESCRIPTION: Setup Project could allow a remote attacker to bypass security restrictions, caused by an issue with adding /sbin/nologin...

Security Bulletin: Vulnerabilities in Python affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in Python. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2018-1061 DESCRIPTION: Python is vulnerable to a denial of service, caused by catastrophic backtracking in the difflib.ISLINEJUNK method. A remote attacker coul...