Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by vulnerability in cURL/libcURL (CVE-2016-7141)

Summary IBM Integrated Management Module II IMM2 has addressed the following vulnerability in cURL/libcURL. Vulnerability Details CVEID: CVE-2016-7141 DESCRIPTION: cURL/libcURL client certificates could allow a remote attacker to bypass security restrictions, caused by an implementation error of...

Security Bulletin: Vulnerability in bind affects IBM Integrated Management Module II (IMM2)

Summary IBM Integrated Managment Module II IMM2 has addressed the following vulnerability in bind. Vulnerability Details CVEID: CVE-2017-3145 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by a use-after-free when improperly sequencing cleanup operations on upstream recursion...

Security Bulletin: Vulnerabilities in OpenSSL affect GCM16 & GCM32 and LCM8 & LCM16 KVM Switch Firmware

Summary IBM GCM16 & GCM32 and LCM8 & LCM16 KVM Switch Firmware have addressed the following vulnerabilities in OpenSSL. Vulnerability Details CVEID: CVE-2017-3738 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow bug in the AVX2 Montgomery...

Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by vulnerability in Libidn2 (CVE-2017-14062)

Summary IBM Integrated Management Module II IMM2 has addressed the following vulnerability in Libidn2. Vulnerability Details CVEID: CVE-2017-14062 DESCRIPTION: Libidn2 is vulnerable to a denial of service, caused by an integer overflow in the decodedigit function in punydecode.c. By persuading a...

Security Bulletin: Vulnerabilities in cURL/libcURL affect IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware

Summary IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware has addressed the following vulnerabilities in cURL/libcURL. Vulnerability Details CVEID: CVE-2017-1000100 DESCRIPTION: cURL could allow a remote attacker to obtain sensitive information, caused by a TFTP URL...

Security Bulletin: IBM Flex System switch firmware products are affected by vulnerabilities in libxml2

Summary Vulnerabilities in libxml2 have been addressed by IBM Flex System switch firmware products listed below. Vulnerability Details CVEID: CVE-2017-5130 DESCRIPTION: Google Chrome is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by libxml2. By persuading a vict...

Security Bulletin: Multiple vulnerabilities in Golang Go affect IBM CICS TX Advanced 11.1 and IBM CICS TX Standard 11.1 (CVE-2023-39318 and CVE-2023-39319).

Summary Multiple vulnerabilities in Golang Go affect IBM CICS TX Advanced 11.1 and IBM CICS TX Standard 11.1 CVE-2023-39318 and CVE-2023-39319. IBM CICS TX Advanced 11.1 and IBM CICS TX Standard 11.1 have addressed the applicable issues. Vulnerability Details CVEID:CVE-2023-39318 DESCRIPTION:...

Security Bulletin: IBM® Db2® is vulnerable to denial of service via a specially crafted query on certain databases. (CVE-2023-30987)

Summary IBM® Db2® is vulnerable to denial of service via a specially crafted query on certain databases. Vulnerability Details CVEID:CVE-2023-30987 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a denial of service due to snappy-java CVE-2023-43642)

Summary snappy-java is used by the IBM App Connect Enterprise and IBM Integration Bus Kafka nodes CVE-2023-43642 Vulnerability Details CVEID: CVE-2023-43642 DESCRIPTION: snappy-java is vulnerable to a denial of service, caused by missing upper bound check on chunk length. By sending a specially...

Security Bulletin: IBM Sterling Connect:Direct Browser User Interface is vulnerable to multiple vulnerabilities due to Eclipse Jetty

Summary IBM Sterling Connect:Direct Browser User Interface uses Eclipse Jetty server. Vulnerability Details CVEID:CVE-2023-41900 DESCRIPTION: Eclipse Jetty could allow a remote authenticated attacker to bypass security restrictions, caused by improper authentication validation when using the...

Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to multiple vulnerabilities due to Eclipse Jetty

Summary IBM Sterling Connect:Direct Web Services uses Eclipse Jetty. Vulnerability Details CVEID:CVE-2023-41900 DESCRIPTION: Eclipse Jetty could allow a remote authenticated attacker to bypass security restrictions, caused by improper authentication validation when using the optional nested...

Security Bulletin: IBM Sterling B2B Integrator is vulnerable to denial of service due to Apache Commons FileUpload (CVE-2023-24998)

Summary IBM Sterling B2B Integrator uses Apache Commons FileUpload. Vulnerability Details CVEID: CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of request parts to be processed in the file upload function. By...

Security Bulletin: IBM Sterling B2B Integrator affected by remote code execution due to Snake Yaml (CVE-2022-1471)

Summary IBM Sterling B2B Integrator uses Snake Yaml. Vulnerability Details CVEID: CVE-2022-1471 DESCRIPTION: SnakeYaml could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in the Constructor class. By using a specially-crafted ya...

Security Bulletin: IBM Sterling B2B Integrator is affected by vulnerability in JDOM (CVE-2021-33813)

Summary IBM Sterling B2B Integrator uses JDOM. Vulnerability Details CVEID: CVE-2021-33813 DESCRIPTION: JDOM is vulnerable to a denial of service, caused by an XXE issue in SAXBuilder. By sending a specially-crafted HTTP request, a remote attacker could exploit this vulnerability to cause the a...

Security Bulletin: IBM Integration Bus is vulnerable to multiple CVEs due to Apache Tomcat.

Summary Due to Apache Tomcat, IBM Integration Bus is vulnerable to multiple CVEs. CVE-2023-45648, CVE-2023-42794, CVE-2023-44487, CVE-2023-42795. Vulnerability Details CVEID: CVE-2023-45648 DESCRIPTION: Apache Tomcat is vulnerable to HTTP request smuggling, caused by improper parsing of HTTP...

Security Bulletin: "Incorrect/Missing Security Headers" affects IBM CICS TX Advanced 10.1.

Summary "Cookie with Insecure, Improper or Missing SameSite attribute" vulnerability affects IBM CICS TX Advanced 10.1. IBM CICS TX Advanced has addressed the applicable vulnerability. Vulnerability Details CVEID:CVE-2023-38363 DESCRIPTION: IBM CICS TX Advanced does not set the secure attribute o...

Security Bulletin: There is a vulnerability in jetty-http-9.4.48.v20220622.jar used by IBM Maximo Asset Management application (CVE-2023-26049)

Summary There is a vulnerability in jetty-http-9.4.48.v20220622.jar used by IBM Maximo Asset Management application CVE-2023-26049 Vulnerability Details CVEID:CVE-2023-26049 DESCRIPTION: Eclipse Jetty could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw...

Security Bulletin: CVE-2023-38737 may affect IBM WebSphere Liberty shipped with IBM TXSeries for Multiplatforms

Summary CVE-2023-38737 may affect IBM WebSphere Liberty shipped with IBM TXSeries for Multiplatforms. IBM TXSeries for Multiplatforms has addressed the applicable vulnerability. Vulnerability Details CVEID: CVE-2023-38737 DESCRIPTION: IBM WebSphere Application Server Liberty 22.0.0.13 through...

Security Bulletin: CVE-2023-38737 affects IBM WebSphere Liberty shipped with IBM CICS TX Advanced

Summary CVE-2023-38737 affects IBM WebSphere Liberty shipped with IBM CICS TX Advanced. IBM CICS TX Advanced has addressed the applicable vulnerability. Vulnerability Details CVEID: CVE-2023-38737 DESCRIPTION: IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a...

Security Bulletin: IBM® Db2® is vulnerable to an information disclosure vulnerability due to the consumed GSKit library (CVE-2023-32342)

Summary IBM® Db2® is vulnerable to an information disclosure vulnerability due to the consumed GSKit library. The fix for this issue was already published in an earlier bulletin. If you have already applied the appropriate Db2 special build or installed GSKit version 8.0.55.31, which contains the...