Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Developer for i and Rational Developer for AIX and Linux

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 7 and 8 that are used by Rational Developer for i and Rational Developer for AIX and Linux. These issues were disclosed as part of the IBM Java SDK updates in April 2018 CVE-2018-2783 and are included in the...

JDK: privilege escalation via insufficiently restricted access to Attach API

In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on...

Security Bulletin: IBM® DB2® LUW on AIX and Linux Affected by vulnerabilities in zlib (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843).

Summary IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server is affected by vulnerabilities in zlib. Vulnerability Details CVEID: CVE-2016-9840 DESCRIPTION: zlib is vulnerable to a denial of service, caused by an out-of-bounds pointer arithmetic in inftrees.c. By persuading a victim to...

Security Bulletin: IBM has released the following fixes for AIX and VIOS in response to Speculative Store Bypass (SSB), also known as Variant 4.

Summary IBM has released the following fixes for AIX and VIOS in response to CVE-2018-3639. Vulnerability Details CVEID: CVE-2018-3639 Affected Products and Versions AIX 5.3, 6.1, 7.1, 7.2 VIOS 2.2.x The vulnerabilities in the following filesets are being addressed: keyfileset = aix Fileset Lower...

IBM has released updated AIX and VIOS fixes for CVE-2017-5715 known as Spectre that are only applicable to some POWER9 systems.

IBM SECURITY ADVISORY First Issued: Fri Aug 17 08:05:01 CDT 2018 |Updated: Mon Sep 24 08:59:02 CDT 2018 |Update: Added system model 9080-M9S as a system to which the bulletin | applies. The most recent version of this document is available here:...

AIX restbyinode Advisory : suid_advisory.asc (IV97852) (IV97957) (IV97958) (IV97959) (IV98013)

The version of restbyinode installed on the remote AIX host is affected by a privilege escalation vulnerability. A local attacker can exploit this to gain root privileges. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid111972; scriptversion"1.4";...

AIX bellmail Advisory : suid_advisory.asc (IV97356) (IV99497) (IV99498) (IV99499)

The version of bellmail installed on the remote AIX host is affected by a privilege escalation vulnerability. A local attacker can exploit this to gain root privileges. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid111969; scriptversion"1.4";...

AIX lquerypv Advisory : suid_advisory.asc (IJ00951) (IV99548) (IV99550) (IV99551) (IV99552)

The version of lquerypv installed on the remote AIX host is affected by a privilege escalation vulnerability. A local attacker can exploit this to gain root privileges. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid111971; scriptversion"1.4";...

AIX bos.acct Advisory : suid_advisory.asc (IV97810) (IV97811) (IV97896) (IV97897) (IV97898) (IV97899) (IV97900) (IV97901)

The version of bosacct installed on the remote AIX host is affected by a privilege escalation vulnerability. A local attacker can exploit this to gain root privileges. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid111970; scriptversion"1.5";...

Security Bulletin: Vulnerabilities in NTP affect AIX

Summary There are multiple vulnerabilities in NTPv3 and NTPv4 that affect AIX. Vulnerability Details NTPv3 is vulnerable to: CVEID: CVE-2014-5209 DESCRIPTION: NTP could allow a remote attacker to obtain sensitive information. By sending a GETRESTRICT control message, an attacker could exploit thi...

CVE-2018-12539

In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on...

Vulnerabilities in NTPv3 affect AIX,Vulnerabilities in NTPv3 affect VIOS,Vulnerabilities in NTPv4 affect AIX,Vulnerabilities in NTPv4 affect VIOS

IBM SECURITY ADVISORY First Issued: Tue Aug 14 14:48:57 CDT 2018 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/ntpadvisory10.asc https://aix.software.ibm.com/aix/efixes/security/ntpadvisory10.asc...

CVE-2017-8988

A Remote Bypass of Security Restrictions vulnerability was identified in HPE XP Command View Advanced Edition Software Earlier than 8.5.3-00. The vulnerability impacts DevMgr Earlier than 8.5.3-00 for Windows, Linux, RepMgr earlier than 8.5.3-00 for Windows, Linux and HDLM earlier than 8.5.3-00 f...

Security feature bypass

A Remote Bypass of Security Restrictions vulnerability was identified in HPE XP Command View Advanced Edition Software Earlier than 8.5.3-00. The vulnerability impacts DevMgr Earlier than 8.5.3-00 for Windows, Linux, RepMgr earlier than 8.5.3-00 for Windows, Linux and HDLM earlier than 8.5.3-00 f...

CVE-2017-8988

CVE-2017-8988 is a remote bypass of security restrictions impacting HPE XP Command View Advanced Edition Software older than 8.5.3-00. Affected components span DevMgr, RepMgr, and HDLM (Windows, Linux; HDLM also on Solaris/AIX). The vulnerability enables bypass of security checks at runtime, with...

Security Bulletin: IBM Communications Server for Data Center Deployment, IBM Communications Server for AIX, IBM Communications Server for Linux, and IBM Communications Server for Linux on System z are affected by a vulnerability.

Summary IBM Communications Server for Data Center Deployment, IBM Communications Server for AIX, IBM Communications Server for Linux, and IBM Communications Server for Linux on System z have addressed the following vulnerability: CVE-2018-1447 GSKit and GSKit-Crypto Security Advisory December 201...

Security Bulletin: Sweet32 vulnerability that impacts Triple DES cipher affects Communications Server for Data Center Deployment, Communications Server for AIX, Linux, Linux on System z, and Windows (CVE-2016-2183)

Summary Sweet32 exposes a problem in the Triple DES algothorim for sessions that receive more than 2 GBytes of data on an encrypted session. Once beyond that amount of data, the algorithm allows for a intrusion that can be more easily decrypted. Vulnerability Details CVEID: CVE-2016-2183...

Security Bulletin: Security Vulnerability in Apache Batik (CVE-2015-0250)

Summary Apache Batik could allow a remote attacker to obtain sensitive information. By persuading a victim to open a specially-crafted SVG file, an attacker could exploit this vulnerability to reveal files and obtain sensitive information. Vulnerability Details CVEID: CVE-2015-0250 DESCRIPTION:...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Developer for i, Rational Developer for AIX and Linux, Rational Developer for Power Systems Software

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 7 and 8 that are used by Rational Developer for i, Rational Developer for AIX and Linux, Rational Developer for Power Systems Software. These issues were disclosed as part of the IBM Java SDK updates in...

Security Bulletin: Multiple OpenSSL and Non-OpenSSL vulnerabilities in Node.js affect IBM Rational Application Developer for WebSphere Software included in Rational Developer for i and Rational Developer for AIX and Linux

Summary Portions of IBM Rational Application Developer for WebSphere Software are shipped as a component of Rational Developer for i RPG and COBOL + Modernization Tools, Java and EGL editions, and Rational Developer for AIX and Linux. OpenSSL vulnerabilities were disclosed on September 22 and 26,...