Security Bulletin: AIX is vulnerable to sensitive information exposure due to Perl (CVE-2023-31484 and CVE-2023-31486)

Summary UPDATED Nov 2: iFixes are now available for Perl 5.28.1 and 5.34.1. Perl version 5.28.1.7 and higher, and Perl version 5.34.1.4 and higher, have a dependency on OpenSSL 3.0. The iFixes are offered in lieu of updating to OpenSSL 3.0 and Perl 5.28.1.8 and 5.34.1.4. The iFixes may be...

Security Bulletin: AIX is vulnerable to a denial of service due to libxml2 (CVE-2022-29824)

Summary UPDATED Dec 12 2022 Added iFixes for AIX 7.2 TL5 SP5 and VIOS 3.1.4.10: A vulnerability in libxml2 could allow a remote attacker to cause a denial of service CVE-2022-29824. AIX uses libxml2 as part of its XML parsing functions. Vulnerability Details CVEID:CVE-2022-29824 DESCRIPTION: GNOM...

Security Bulletin: Vulnerabilities in IBM Java Runtime affecting Tivoli Netcool/OMNIbus (Multiple CVEs)

Summary There are vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 8 that is used by Tivoli Netcool/OMNIbus. These were disclosed as part of the IBM Java SDK updates in April 2023. Affected platforms are AIX, Linux, Linux on zSystems, and Windows. Vulnerability Detail...

Security Bulletin: AIX is vulnerable to a denial of service due to libxml2 (CVE-2023-29469 and CVE-2023-28484)

Summary Vulnerabilities in libxml2 could allow a remote attacker to cause a denial of service CVE-2023-29469 and CVE-2023-28484. AIX uses libxml2 as part of its XML parsing functions. Vulnerability Details CVEID:CVE-2023-29469 DESCRIPTION: GNOME libxml2 is vulnerable to a denial of service, cause...

Security Bulletin: A vulnerability exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Configuration Manager (CVE-2023-22045, CVE-2023-22049).

Summary A vulnerability exists in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Configuration Manager IP Edition v6.4.2 Vulnerability Details CVEID:CVE-2023-22045 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a...

Security Bulletin: Vulnerability in AIX affect OS Image for AIX shipped with Cloud Pak System (CVE-2022-22444)

Summary Vulnerability in AIX affect OS Image for AIX shipped with Cloud Pak System. Cloud Pak System has addressed vulnerability. Vulnerability Details CVEID:CVE-2022-22444 DESCRIPTION: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a local user to exploit a vulnerability in the lpd daemon to...

Security Bulletin: AIX is vulnerable to a denial of service due to NTP (CVE-2023-26551, CVE-2023-26552, CVE-2023-26553, CVE-2023-26554)

Summary Multiple vulnerabilities in NTP could allow a remote attacker to cause a denial of service CVE-2023-26551, CVE-2023-26552, CVE-2023-26553, CVE-2023-26554. Vulnerability Details CVEID:CVE-2023-26551 DESCRIPTION: NTP is vulnerable to a denial of service, caused by an out-of-bounds write in...

AIX is vulnerable to sensitive information exposure due to Perl - CVE-2023-2331486,AIX is vulnerable to sensitive information exposure due to Perl - CVE-2023-31484

IBM SECURITY ADVISORY First Issued: Thu Oct 5 10:44:37 CDT 2023 |Updated: Thu Nov 2 09:55:16 CDT 2023 |Update: iFixes are now available for Perl 5.28.1 and 5.34.1. | Perl version 5.28.1.7 and higher, and Perl version 5.34.1.4 and higher, | have a dependency on OpenSSL 3.0. | The iFixes are offere...

AIX is vulnerable to a denial of service due to NTP

IBM SECURITY ADVISORY First Issued: Thu Oct 5 10:43:28 CDT 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/ntpadvisory14.asc Security Bulletin: AIX is vulnerable to a denial of service due to NTP CVE-2023-26551, CVE-2023-26552,...

Security Bulletin: Vulnerabilities in Apache Commons Codec affect IBM Storage Protect Backup-Archive Client, IBM Storage Protect for Virtual Environments, and IBM Storage Protect for Space Management can lead to information disclosure

Summary IBM Storage Protect Backup-Archive Client, IBM Storage Protect for Virtual Environments Data Protection for Hyper-V and Data Protection for VMware, and IBM Storage Protect for Space Management can be affected by a vulnerability in Apache Commons Codec library. The vulnerability can lead t...

Security Bulletin: A vulnerability in the Administrative command line client affects IBM Storage Protect Client, IBM Storage Protect for Virtual Environments, and IBM Storage Protect for Space Management (CVE-2023-40368)

Summary IBM Storage Protect Backup-Archive Client, IBM Storage Protect for Virtual Environments Data Protection for Hyper-V and Data Protection for VMware, and IBM Storage Protect for Space Management, can be affected by a vulnerability in the Administrative command line interface. The...

Security Bulletin: IBM Storage Protect is vulnerable to deserialization issues due to Java ( CVE-2022-40609 )

Summary IBM Storage Protect Server and Operations Center use Java and may be affected by the vulnerability. Vulnerability Details CVEID:CVE-2022-40609 DESCRIPTION: IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused b...

Security Bulletin: IBM Storage Protect Operations Center is vulnerable to denial of service due to Websphere Application Server Liberty ( CVE-2023-28867 )

Summary IBM Storage Protect Operations Center uses Liberty and may be vulnerable. Vulnerability Details CVEID:CVE-2023-28867 DESCRIPTION: GraphQL Java is vulnerable to a denial of service, caused by a stack-based buffer overflow. By sending a specially crafted GraphQL query, a remote attacker cou...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect AIX

Summary There are multiple vulnerabilities in OpenSSL as used by AIX. OpenSSL is used by AIX as part of AIX's secure network communications. Vulnerability Details CVEID:CVE-2023-0464 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an error related to the verification of X.509...

Multiple vulnerabilities in OpenSSL affect AIX

IBM SECURITY ADVISORY First Issued: Mon Sep 11 10:43:54 CDT 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/openssladvisory39.asc Security Bulletin: Multiple vulnerabilities in OpenSSL affect AIX...

Security Bulletin: AIX is vulnerable to arbitrary command execution (CVE-2023-26286)

Summary A vulnerability in the AIX runtime services library could allow a non-privileged local user to execute arbitrary commands CVE-2023-26286. Vulnerability Details CVEID:CVE-2023-26286 DESCRIPTION: IBM AIX could allow a non-privileged local user to exploit a vulnerability in the AIX runtime...

Security Bulletin: Timing in RSA Decryption vulnerability might affect GSKit supplied with IBM TXSeries for Multiplatforms

Summary Timing in RSA Decryption vulnerability might affect GSKit supplied with IBM TXSeries for Multiplatforms. IBM TXSeries for Multiplatforms has addressed the applicable vulnerability. Vulnerability Details CVEID:CVE-2023-32342 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain...

Security Bulletin: AIX is vulnerable to denial of service due to ISC BIND (CVE-2023-2828)

Summary A vulnerability in ISC BIND could allow a remote attacker to cause a denial of service CVE-2023-2828. AIX uses ISC BIND as part of its DNS functions. Vulnerability Details CVEID:CVE-2023-2828 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by a flaw that allows the...

AIX is vulnerable to denial of service due to ISC BIND

IBM SECURITY ADVISORY First Issued: Thu Sep 7 13:08:07 CDT 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/bindadvisory24.asc Security Bulletin: AIX is vulnerable to denial of service due to ISC BIND CVE-2023-2828...

Security Bulletin: IBM Storage Protect Snapshot for UNIX and Linux is vulnerable to sensitive information disclosure due to IBM GSKit ( CVE-2023-32342 )

Summary IBM GSKit is used by IBM Storage Protect Snapshot for UNIX and Linux and may be affected by vulnerability CVE-2023-32342. Vulnerability Details CVEID:CVE-2023-32342 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel ...