Security Bulletin: Vulnerability in Apache ActiveMQ Affects IBM Control Center (CVE-2019-0222)

Summary IBM Control center is affected by a Corrupt MQTT frame that can cause broker shutdown in Apache ActiveMQ. Vulnerability Details CVEID: CVE-2019-0222 DESCRIPTION: IBM Control center is affected by a Corrupt MQTT frame that can cause broker shutdown in Apache ActiveMQ. CVSS Base Score: 7.5...

Security Bulletin: IBM Planning Analytics Local is affected by multiple vulnerabilities (CVE-2018-12116, CVE-2018-12121, CVE-2018-12122, CVE-2018-12123)

Summary The Planning Analytics Workspace component of IBM Planning Analytics is vulnerable to multiple Node.js vulnerabilities. The version of Node.js use by IBM Planning Analytics Workspace has been upgraded to address these vulnerabilities. Vulnerability Details CVEID: CVE-2018-12116 DESCRIPTIO...

Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerability in OpenSSH (CVE-2018-15473)

Summary IBM Advanced Management Module AMM has addressed the following vulnerability in OpenSSH. Vulnerability Details CVEID: CVE-2018-15473 DESCRIPTION: OpenSSH could allow a remote attacker to obtain sensitive information, caused by different responses to valid and invalid authentication...

Security Bulletin: IBM RackSwitch firmware products are affected by vulnerability in OpenSSL (CVE-2018-0732)

Summary IBM RackSwitch firmware products listed below have addressed the following vulnerability in OpenSSL. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a malicious server...

Security Bulletin: A Security Vulnerability affects IBM Cloud Private Metering

Summary A Security Vulnerability affects IBM Cloud Private Metering Vulnerability Details CVEID: CVE-2018-10904 DESCRIPTION: glusterfs could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper validation of file paths in the trusted.io-stats-dump...

Security Bulletin: IBM RackSwitch firmware products are affected by vulnerability in Python (CVE-2017-1000158)

Summary Vulnerability in Python has been addressed by IBM RackSwitch firmware products listed below. Vulnerability Details CVEID: CVE-2017-1000158 DESCRIPTION: CPython is vulnerable to a heap-based buffer overflow, caused by an integer overflow in the PyStringDecodeEscape function in...

Security Bulletin: Vulnerabiliies in glibc affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in glibc. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2018-11237 DESCRIPTION: GNU glibc is vulnerable to a buffer overflow, caused by improper bounds of checking by the mempcpyavx512novzeroupper function. By executi...

Security Bulletin: A vulnerability in Bind affects PowerKVM

Summary PowerKVM is affected by a vulnerability in Bind. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2018-5742 DESCRIPTION: BIND packages in RedHat and CentOS are vulnerable to a denial of service, caused by an assertion error when debug log level is 10 or higher. A...

Security Bulletin: A vulnerability in Polkit affects PowerKVM

Summary PowerKVM is affected by a vulnerability in Polkit. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2019-6133 DESCRIPTION: PolicyKit could allow a remote attacker to bypass security restrictions, caused by the lack of uid checking in...

Security Bulletin: A vulnerability in keepalived affects PowerKVM

Summary PowerKVM is affected by a vulnerability in keepalived. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2018-19115 DESCRIPTION: keepalived is vulnerable to a denial of service, caused by a heap-based buffer overflow flaw in the extractstatuscode function in...

Security Bulletin: A vulnerability in Ruby affects PowerKVM

Summary PowerKVM is affected by a vulnerability in Ruby. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2018-16395 DESCRIPTION: Ruby could allow a remote attacker to bypass security restrictions, caused by a flaw when comparing two OpenSSL::X509::Name objects using == ...

Security Bulletin: Vulnerabiliies in libmspack affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in libmspack. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2018-14682 DESCRIPTION: libmspack is vulnerable to a denial of service, caused by an off-by-one in mspack/chmd.c in the TOLOWER macro for CHM decompression. ...

Security Bulletin: Vulnerabilities in the Linux Kernel affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in the Linux Kernel. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2018-18710 DESCRIPTION: Linux Kernel could allow a local attacker to obtain sensitive information, caused by improper bounds checking in...

Security Bulletin: A vulnerability in Spice affects PowerKVM

Summary PowerKVM is affected by a vulnerability in Spice. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2019-3813 DESCRIPTION: Spice is vulnerable to a denial of service, caused by an off-by-one error in array access in spice/server/memslot.c. A local attacker could...

Security Bulletin: IBM InfoSphere Change Data Capture is affected by a jackson-core open source library vulnerability (CVE-2018-0125)

Summary InfoSphere Data Replication has addressed the following vulnerability: CVE-2018-0125 Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow a remote attacker to execute arbitrary code on the system, caused by an incomplete input validation on user-controll...

Security Bulletin: Apache Commons FileUpload Vulnerability Can Affect IBM Sterling Order Management (CVE-2016-1000031)

Summary IBM Sterling Order Management uses Apache Commons FileUpload and is affected by some of the vulnerabilities that exist in Apache Commons FileUpload. Vulnerability Details CVEID: CVE-2016-1000031 DESCRIPTION: Apache Commons FileUpload, as used in Novell NetIQ Sentinel and other products,...

Security Bulletin: Enterprise Content Management System Monitor is affected by a vulnerability in IBM® SDK Java™ Technology Edition

Summary Enterprise Content Management System Monitor has addressed the following vulnerability in IBM® SDK Java™ Technology Edition. This issue was disclosed as part of the IBM® SDK Java™ Technology Edition Quarterly CPU - Oct 2018 - Includes Oracle Oct 2018 CPU. Vulnerability Details CVEID:...

Security Bulletin: IBM NeXtScale Fan Power Controller (FPC) is affected by OpenSLP vulnerability (CVE-2017-17833)

Summary IBM NeXtScale Fan Power Controller FPC has addressed the following vulnerability in OpenSLP. Vulnerability Details Summary IBM NeXtScale Fan Power Controller FPC has addressed the following vulnerability in OpenSLP. Vulnerability Details CVEID: CVE-2017-17833 Description: OpenSLP, as used...

Security Bulletin: IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru is affected by vulnerability in OpenSLP (CVE-2017-17833)

Summary The following vulnerability in OpenSLP has been addressed by IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru firmware. Vulnerability Details Summary The following vulnerability in OpenSLP has been addressed by IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru firmware...

Security Bulletin: Vulnerability in OpenSSL affects MegaRAID Storage Manager (CVE-2016-7055)

Summary MegaRAID Storage Manager has addressed the following vulnerability in OpenSSL. Vulnerability Details Summary MegaRAID Storage Manager has addressed the following vulnerability in OpenSSL. Vulnerability Details CVEID: CVE-2016-7055 Description: OpenSSL is vulnerable to a denial of service,...