Security Bulletin: Ceilometer database access unrestricted in PowerVC (CVE-2015-1937)

Summary IBM PowerVC is using a ceilometer database that does not have authentication enabled. Vulnerability Details CVEID: CVE-2015-1937 DESCRIPTION: IBM PowerVC NoSQL database used by ceilometer is listening on the remote port and is configured to allow connections without any authentication. A...

Security Bulletin: Vulnerabilities in IPv6 and MQ affect the IBM FlashSystem model V840

Summary There are vulnerabilities in the IPv6 and MQ components which affect the IBM FlashSystem™ V840. An exploit of these vulnerabilities CVE-2016-10142 and CVE-2017-11176 could make the system susceptible to attacks which could allow an attacker to trigger a kernel panic or denial of service...

Security Bulletin: XML Entity Expansion vulnerability (CVE-2018-1702) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary XML Entity Expansion vulnerability CVE-2018-1702 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1702 DESCRIPTION: IBM Spectrum Symphony is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could...

Security Bulletin: Vulnerability in IBM Java Runtime affect Rational Host On-Demand (CVE-2016-0603)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 1.6 , 1.7 and 1.8 that is used by Rational Host On Demand .JRE installation executables on the Windows platform are affected by this vulnerability. Vulnerability Details CVE-ID: CVE-2016-0603 Descriptio...

Security Bulletin: Stored Cross-Site Scripting (XSS) vulnerability (CVE-2018-1707) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary Stored Cross-Site Scripting XSS vulnerability CVE-2018-1707 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1707 DESCRIPTION: IBM Platform Symphony is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri...

Security Bulletin: IBM Spectrum Scale and IBM GPFS are affected by security vulnerabilities (CVE-2015-4974, CVE-2015-4981)

Summary Security vulnerabilities have been identified in the current levels of IBM Spectrum Scale V4.1.1, IBM GPFS V4.1 and V3.5: - could allow a local non privileged attacker to execute commands with root privileges CVE-2015-4974 - could allow a local non privileged attacker to read system...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum Scale (CVE-2015-4843, CVE-2015-4805, CVE-2015-4810, CVE-2015-4806, CVE-2015-4871, CVE-2015-4902)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 that is used by the IBM Spectrum Scale GUI. These issues were disclosed as part of the IBM Java SDK updates for October 2015. Vulnerability Details CVEID: CVE-2015-4843 DESCRIPTION: An unspecified...

Security Bulletin: IBM Spectrum Scale Object Protocols functionality (Linux Standard and Advanced) is affected by security vulnerabilities in the TLS and SSL protocols (CVE-2015-2808 and CVE-2014-3566)

Summary IBM Spectrum Scale Object Protocols functionality Linux Standard and Advanced is affected by security vulnerabilities in the TLS and SSL protocols CVE-2015-2808 and CVE-2014-3566 Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL...

Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerabilities in php

Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerabilities in php. Vulnerability Details CVEID: CVE-2018-7584 DESCRIPTION: PHP is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the phpstreamurlwraphttpex function in...

Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by a vulnerability in ncurses (CVE-2017-13733)

Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerability in ncurses. Vulnerability Details CVEID: CVE-2017-13733 DESCRIPTION: Ncurses is vulnerable to a denial of service, caused by an illegal address access in the fmtentry function in progs/dumpentry.c. By...

Security Bulletin: IBM Cúram Social Program Management contains an Apache Batik Vulnerability (CVE-2015-0250)

Summary IBM Cúram is shipped with a third party library called Apache Batik, which is vulnerable to specially crafted SVG files. These files can potientially be used to reveal files and obtain sensitive information. Vulnerability Details CVEID: CVE-2015-0250 DESCRIPTION: Apache Batik could allow ...

Security Bulletin: IBM Cúram Universal Access is vulnerable to CRLF Injection attack when not deployed on IBM WebSphere. (CVE-2014-4803)

Summary The Universal Access component of IBM Cúram Social Program Management, when not deployed on IBM WebSphere Application Server, is vulnerable to CRLF Injection attack; this is caused by improper sanitization/escaping of a parameter on one page. Vulnerability Details CVEID: CVE-2014-4803 A...

Security Bulletin: OpenSSL vulnerabilties affect IBM NeXtScale Fan Power Controller (FPC)

Summary IBM NeXtScale Fan Power Controller FPC has addressed the following vulnerabilities in OpenSSL. Vulnerability Details CVEID: CVE-2018-0739 DESCRIPTION: OpenSSL is vulnerable to a denial of service. By sending specially crafted ASN.1 data with a recursive definition, a remote attacker could...

Security Bulletin: Vulnerabilities in krb5 affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in MIT Kerberos 5 krb5. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2017-11368 DESCRIPTION: MIT Kerberos 5 is vulnerable to a denial of service, caused by a KDC assertion failure. By sending a specially-crafted...

Security Bulletin: Vulnerabilities in OpenSSL affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in OpenSSL. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2017-3738 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow bug in the AVX2 Montgomery multiplication...

Security Bulletin: A vulnerability in libvorbis affects PowerKVM

Summary PowerKVM is affected by a vulnerability in libvorbis. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2018-5146 DESCRIPTION: libvorbis, as used in Mozilla Firefox, could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds...

Security Bulletin: Vulnerabilities in procps-ng affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in procps-ng. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2018-1126 DESCRIPTION: procps-ng procps is vulnerable to a buffer overflow, caused by improper bounds checking. By sending a specially-crafted request, a...

Security Bulletin: A vulnerability in OpenSSH affects PowerKVM

Summary PowerKVM is affected by a vulnerability in OpenSSH. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2017-15906 DESCRIPTION: OpenSSH is vulnerable to a denial of service, caused by an error in the processopen function when in read-only mode. A remote authenticate...

Security Bulletin: A vulnerability in DHCP affects PowerKVM

Summary PowerKVM is affected by a vulnerability in the DHCP client. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2018-1111 DESCRIPTION: The DHCP client packages in Red Hat Enterprise Linux could allow a remote attacker on the local network to execute arbitrary comman...

Security Bulletin: Denial of Service attack possible on Cúram instances using Apache Commons FileUpload (CVE-2014-0050)

Summary A version of Apache Commons FileUpload shipped with Cúram is vulnerable to a denial of service attack. Vulnerability Details CVEID: CVE-2014-0050 DESCRIPTION: Apache Commons FileUpload is vulnerable to a denial of service, caused by the improper handling of Content-Type HTTP header for...