Security Bulletin: IBM XIV is affected by a vulnerability in OpenSSL (CVE-2014-0160)

Summary A security vulnerability has been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerability...

Security Bulletin: CLI access security issue on IBM System Storage Storwize V7000 Unified (CVE-2014-0880)

Summary CLI security issue. Vulnerability Details CVEID: CVE-2014-0880 DESCRIPTION: An unauthorized user with network access to a system's administrative IP Internet Protocol address may be able to gain access to the block CLI Command Line Interface of the system, allowing the user to issue all...

Fedora 27 : singularity (2018-02051f8300)

This rebases singularity from 2.2.1 to 2.5.1, which should include all corresponding updates n.b. a request for rebase permission has been put into FESCo; hence auto-push has been disabled until they approve. Please test for functionality and backward compatibility issues, particularly around the...

SUSE SLES12 Security Update : xen (SUSE-SU-2018:1699-1) (Meltdown) (Spectre)

This update for xen fixes several issues. This feature was added : - Added support for qemu monitor command These security issues were fixed : - CVE-2018-3639: Prevent attackers with local user access from extracting information via a side-channel analysis, aka Speculative Store Bypass SSB, Varia...

Fedora 27 : libgcrypt (2018-6788454ab6)

Minor security update to version 1.8.3 from upstream. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Security Bulletin: IBM QRadar Network Security is affected by vulnerabilities in Linux kernel

Summary IBM QRadar Network Security has addressed vulnerabilities in Linux kernel. Vulnerability Details CVEID: CVE-2017-1000251 DESCRIPTION: Linux Kernel is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the native Bluetooth stack. By processing L2CAP...

Security Bulletin: IBM QRadar Network Security is affected by a denial of service vulnerability in cURL (CVE-2017-1000257)

Summary IBM QRadar Network Security has addressed the denial of service vulnerability in cURL. Vulnerability Details CVEID: CVE-2017-1000257 DESCRIPTION: cURL is vulnerable to a denial of service, caused by a buffer overread in the IMAP handler. By using a specially crafted IMAP FETCH response, a...

Security Bulletin: IBM QRadar Network Security is affected by vulnerability in subversion (CVE-2017-9800)

Summary IBM QRadar Network Security has addressed vulnerability in subversion. Vulnerability Details CVEID: CVE-2017-9800 DESCRIPTION: Apache Subversion could allow a remote attacker to execute arbitrary commands on the system, caused by the connection to URLs provided by the repository. By...

Security Bulletin: IBM QRadar Network Security is affected by a vulnerability in glibc

Summary IBM QRadar Network Security has addressed security vulnerabilities in glibc. Vulnerability Details CVEID: CVE-2014-9761 DESCRIPTION: GNU C Library glibc is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the nan function. By sending an overly long string...

Security Bulletin: IBM QRadar Network Security is affected by vulnerabilities in Linux kernel

Summary IBM QRadar Network Security has addressed vulnerabilities in Linux kernel. Vulnerability Details CVEID: CVE-2017-1000364 DESCRIPTION: Linux Kernel could allow a local attacker to gain elevated privileges on the system, caused by a a stack memory allocation flaw that allows the stack guard...

Security Bulletin: IBM QRadar Network Security is affected by vulnerabilities in tcpdump

Summary IBM QRadar Network Security has addressed vulnerabilities in tcpdump. Vulnerability Details CVEID: CVE-2016-7986 DESCRIPTION: tcpdump is vulnerable to a buffer overflow, caused by improper bounds checking by the GeoNetworking parser in the print-geonet.c and other functions. By sending an...

Security Bulletin: IBM QRadar Network Security is affected by vulnerabilities in openssh (CVE-2016-10009 CVE-2016-10011 CVE-2016-10012 CVE-2016-6210 CVE-2016-6515)

Summary IBM QRadar Network Security has addressed vulnerabilities in openssh. Vulnerability Details CVEID: CVE-2016-6515 DESCRIPTION: OpenSSH is vulnerable to a denial of service, caused by the failure to limit password lengths for password authentication by the authpassword function. A remote...

Security Bulletin: IBM QRadar Network Security is affected by vulnerabilities in libtasn1 (CVE-2015-3622, CVE-2015-2806)

Summary IBM QRadar Network Security has addressed vulnerabilities in libtasn1. Vulnerability Details CVEID: CVE-2015-3622 DESCRIPTION: GNU Libtasn1 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the asn1extractderoctet function. By sending an overly long...

Security Bulletin: IBM QRadar Network Security is affected by vulnerabilities in bash (CVE-2016-9401, CVE-2016-7543, CVE-2016-0634)

Summary IBM QRadar Network Security has addressed vulnerabilities in bash. Vulnerability Details CVEID: CVE-2016-9401 DESCRIPTION: GNU Bash could allow a local attacker to bypass security restrictions, caused by a use-after-free error. An attacker could exploit this vulnerability using a speciall...

Security Bulletin: IBM QRadar Network Security is affected by potential issues of XML External Entity Injection (CVE-2017-1458)

Summary IBM QRadar Network Security has addressed potential issues of XML External Entity Injection. Vulnerability Details CVEID: CVE-2017-1458 DESCRIPTION: IBM QRadar Network Security is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could...

Security Bulletin: IBM QRadar Network Security is affected by a vulnerability in Curl (CVE-2016-7167)

Summary IBM QRadar Network Security has addressed a vulnerability in Curl. Vulnerability Details CVEID: CVE-2016-7167 DESCRIPTION: libcurl could allow a local attacker to execute arbitrary code on the system, caused by an integer overflow in the curlescape, curleasyescape, curlunescape, and...

Security Bulletin: IBM QRadar Network Security is affected by potential issues of Cross-Site Scripting (CVE-2017-1457)

Summary IBM QRadar Network Security has addressed potential issues of Cross-Site Scripting Vulnerability Details CVEID: CVE-2017-1457 DESCRIPTION: IBM QRadar Network Security is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th...

Security Bulletin: IBM QRadar Network Security is affected by vulnerabilities in Linux kernel

Summary IBM QRadar Network Security has addressed vulnerabilities in Linux kernel. Vulnerability Details CVEID: CVE-2017-6074 DESCRIPTION: Linux kernel is vulnerable to a denial of service, caused by improper handling of DCCPPKTREQUEST packet data structures in the LISTEN state by the...

Security Bulletin: IBM QRadar Network Security is affected by a less-secure algorithm during negotiations vulnerability (CVE-2017-1491)

Summary IBM QRadar Network Security has addressed less-secure algorithm during negotiations Vulnerability Details CVEID: CVE-2017-1491 DESCRIPTION: IBM QRadar Network Security supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a...

Security Bulletin: IBM QRadar Network Security has updated commons-fileupload for known vulnerabilities (CVE-2016-3092)

Summary IBM QRadar Network Security has updated commons-fileupload to address its known vulnerabilities. Vulnerability Details CVEID: CVE-2016-3092 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component. By sending file uploa...