AIX is vulnerable to arbitrary command execution (CVE-2024-56346 CVE-2024-56347)

IBM SECURITY ADVISORY First Issued: Tue Mar 18 10:46:14 CDT 2025 |Updated: Thu Apr 10 09:01:49 CDT 2025 |Update: The included README was updated for clarity. The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/nimadvisory.asc Security...

PT-2025-11629

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 Description The IBM AIX nimesis NIM master service has a flaw in its process controls that could allow a remote attacker to execute arbitrary commands. This issue is actively exploited. The vulnerability affects th...

PT-2025-11630

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 through 7.3 Description The nimsh service SSL/TLS protection mechanisms in IBM AIX could allow a remote attacker to execute arbitrary commands due to improper process controls. Recommendations For IBM AIX versions 7.2...

IBM AIX 安全漏洞

IBM AIX is an open standards-based UNIX operating system developed for the IBM Power architecture by International Business Machines IBM. A security vulnerability exists in IBM AIX versions 7.2 and 7.3, which stems from improper control of the nimsh service SSL/TLS protection mechanism process an...

IBM AIX 安全漏洞

IBM AIX is an open standards-based UNIX operating system developed for the IBM Power architecture by International Business Machines IBM. A security vulnerability exists in IBM AIX versions 7.2 and 7.3 that stems from improper control of the nimesis NIM master service process, which could allow a...

Security Bulletin: AIX is vulnerable to a denial of service (CVE-2025-26466) and a machine-in-the-middle attack (CVE-2025-26465) due to OpenSSH

Summary Vulnerabilities in AIX's OpenSSH could allow a remote attacker to cause a denial of service CVE-2025-26466 or a machine-in-the-middle attack CVE-2025-26465. OpenSSH is used by AIX for remote login. Vulnerability Details CVEID:CVE-2025-26466 DESCRIPTION: A flaw was found in the OpenSSH...

AIX is vulnerable to a denial of service (CVE-2025-26466) and a machine-in-the-middle attack (CVE-2025-26465) due to OpenSSH

IBM SECURITY ADVISORY First Issued: Mon Mar 17 15:30:45 CDT 2025 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/opensshadvisory18.asc Security Bulletin: AIX is vulnerable to a denial of service CVE-2025-26466 and a machine-in-the-middl...

Security Bulletin: AIX is affected by a denial of service (CVE-2024-50602) due to Python

Summary Vulnerability in Python could allow a remote attacker to cause a denial of service CVE-2024-50602. Python is used by AIX as part of Ansible node management automation. Vulnerability Details CVEID:CVE-2024-50602 DESCRIPTION: An issue was discovered in libexpat before 2.6.4. There is a cras...

AIX is affected by a denial of service (CVE-2024-50602) due to Python

IBM SECURITY ADVISORY First Issued: Thu Mar 6 15:42:23 CST 2025 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/pythonadvisory14.asc Security Bulletin: AIX is affected by a denial of service CVE-2024-50602 due to Python...

AIX is vulnerable to information disclosure (CVE-2024-13176) or arbitrary code execution or a denial of service (CVE-2024-9143) due to OpenSSL

IBM SECURITY ADVISORY First Issued: Mon Feb 24 15:15:11 CST 2025 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/openssladvisory44.asc Security Bulletin: AIX is vulnerable to information disclosure CVE-2024-13176 or arbitrary code...

CVE-2022-41290

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the rmrlcachefile command to obtain root privileges. IBM X-Force ID: 236690...

CVE-2024-25021

IBM AIX 7.3, VIOS 4.1's Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary commands. IBM X-Force ID: 281320...

CVE-2024-47115

IBM AIX 7.2, 7.3 and VIOS 3.1 and 4.1 could allow a local user to execute arbitrary commands on the system due to improper neutralization of input...

CVE-2024-27273

IBM AIX's Unix domain AIX 7.2, 7.3, VIOS 3.1, and VIOS 4.1 datagram socket implementation could potentially expose applications using Unix domain datagram sockets with SOPEERID operation and may lead to privilege escalation. IBM X-Force ID: 284903...

CVE-2024-27260

IBM AIX could 7.2, 7.3, VIOS 3.1, and VIOS 4.1 allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. IBM X-Force ID: 283985...

Security Bulletin: IBM Storage Protect Server is susceptible to vulnerability in Golang Go (CVE-2023-45288).

Summary Golang Go is used by the IBM Storage Protect Server OSSM component. Golang Go is vulnerable to loss of availability of host system. This bulletin identifies the steps to address the vulnerability. Vulnerability Details CVEID:CVE-2023-45288 DESCRIPTION: An attacker may cause an HTTP/2...

Security Bulletin: AIX is vulnerable to a denial of service due to libxml2 (CVE-2024-25062)

Summary Vulnerability in libxml2 could allow a remote attacker to cause a denial of service CVE-2024-25062. AIX uses libxml2 as part of its XML parsing functions. Vulnerability Details CVEID:CVE-2024-25062 DESCRIPTION: An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. Whe...

Security Bulletin: IBM Storage Protect Server is vulnerable to denial of service due to Golang Go ( CVE-2023-24534 )

Summary Golang Go is used by IBM Storage Protect Server and may be affected by vulnerability CVE-2023-24534. Vulnerability Details CVEID:CVE-2023-24534 DESCRIPTION: HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial o...

Security Bulletin: XML External Entity Injection attack in IBM WebSphere Application Server Liberty may affect IBM Storage Protect Operations Center (CVE-2024-22354).

Summary IBM Storage Protect Operations Center may be affected by loss of confidentiality, availability and integrity of host system caused by XML External Entity Injection XXE attack in IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2024-22354 DESCRIPTION: IBM WebSphere...

Security Bulletin: AIX is vulnerable to a denial of service (CVE-2024-6119) due to OpenSSL

Summary Vulnerability in OpenSSL could allow a remote attacker to cause a denial of service CVE-2024-6119. OpenSSL is used by AIX as part of AIX's secure network communications. Vulnerability Details CVEID:CVE-2024-6119 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an error...