Security Bulletin: Denial of Service attack possible on Cúram instances using Apache Santuario (CVE-2013-4517)

Summary A version of Apache Santuario XML Security for Java shipped with Cúram is vulnerable to a denial of service attack. Customers that use xmlsec.jar to secure web services may be affected. Vulnerability Details CVEID: CVE-2013-4517 DESCRIPTION: Apache Santuario XML Security for Java is...

Security Bulletin: IBM Cúram Universal Access V6.0.5.5 can be vulnerable to CRLF Injection attack (CVE-2014-3069)

Summary IBM Cúram Universal Access is vulnerable to CRLF Injection attack when not deployed on IBM WebSphere. Vulnerability Details CVE ID: CVE-2014-3069 DESCRIPTION: The Universal Access component of IBM Cúram Social Program Management, when not deployed on IBM WebSphere Application Server, is...

Security Bulletin: Cross-site Scripting Vulnerability Addressed in Asset and Service Management (CVE-2014-3025)

Summary Cross-site scripting security vulnerability on webclient/utility/.jsp in Maximo Asset Mgmt, Tivoli Asset Mgmt for IT, Tivoli Service Request Mgr, Change and Configuration Mgmt Database, and SmartCloud Control Desk. Vulnerability Details DESCRIPTION: Customers who have Maximo Asset...

Security Bulletin: A vulnerability in Open Source Apache Tomcat affects the IBM FlashSystem V840, (CVE-2014-0227)

Summary There is a vulnerability in Open Source Apache Tomcat that is used by the IBM FlashSystem V840 which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service under error scenarios. Vulnerability Details CVE-ID: CVE-2014-0227 Description: Apache Tomcat...

Security Bulletin: Vulnerabilities in DHCP affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in DHCP. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2018-5733 DESCRIPTION: ISC DHCP is vulnerable to a denial of service. By sending an overly large amount of packets, a remote attacker could overflow a reference...

Security Bulletin: A vulnerability in PHP affects PowerKVM

Summary PowerKVM is affected by a vulnerability in PHP. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2017-7890 DESCRIPTION: libgd could allow a remote attacker to obtain sensitive information, caused by the lack of initialization for colorMap arrays in the GIF decodi...

Security Bulletin: A vulnerability in curl affects PowerKVM

Summary PowerKVM is affected by a vulnerability in curl. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2017-1000257 DESCRIPTION: cURL is vulnerable to a denial of service, caused by a buffer overread in the IMAP handler. By using a specially crafted IMAP FETCH respons...

Security Bulletin: Vulnerabilities in wget affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in wget. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2017-13090 DESCRIPTION: GNU wget is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the fdreadbody function in src/retr.c. By...

Security Bulletin: A vulnerability in nginx affects PowerKVM

Summary PowerKVM is affected by a vulnerability in nginx. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2017-7529 DESCRIPTION: Nginx could allow a remote attacker to obtain sensitive information, caused by an integer overflow in Nginx range filter module. By sending...

Security Bulletin: A vulnerability in bluez affects PowerKVM

Summary PowerKVM is affected by a vulnerability in bluez. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2017-1000250 DESCRIPTION: BlueZ could allow a remote attacker to obtain sensitive information, caused by an error in the SDP server. By sending SDP request packets,...

Security Bulletin: A vulnerability in emacs affects PowerKVM

Summary PowerKVM is affected by a vulnerability in emacs. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2017-14482 DESCRIPTION: GNU Emacs could allow a remote attacker to execute arbitrary code on the system, caused by improper validation of user request. By sending a...

Security Bulletin: A vulnerability in ausgeas affects PowerKVM

Summary PowerKVM is affected by a vulnerability in ausgeas. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2017-7555 DESCRIPTION: Augeas is vulnerable to a heap-based buffer overflow. By sending specially crafted strings, a remote attacker could overflow a buffer and...

Security Bulletin: Vulnerabilities in the Linux kernel affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in the Linux kernel . IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2017-12153 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference in the nl80211setrekeydata function i...

Security Bulletin: Vulnerabilities in Apache HTTPD affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in Apache HTTPD. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2017-9788 DESCRIPTION: Apache HTTPD is vulnerable to a denial of service, caused by the failure to properly initialize memory used to process ''Digest''...

Security Bulletin: Vulnerabilities in PostgreSQL affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in PostgreSQL IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2017-7486 DESCRIPTION: PostgreSQL could allow a remote authenticated attacker to obtain sensitive information, caused by improper implementation of...

Security Bulletin: A vulnerability in Spice affects PowerKVM

Summary PowerKVM is affected by a vulnerability in Spice. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2017-7506 DESCRIPTION: spice is vulnerable to a denial of service, caused by an out-of-bounds write error when processing message. By sending specially-crafted...

Security Bulletin: A vulnerability in Ghostscript affects PowerKVM

Summary PowerKVM is affected by a vulnerability in Ghostscript. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2017-7207 DESCRIPTION: Artifex Software Ghostscript is vulnerable to a denial of service, caused by a NULL pointer dereference in the memgetbitsrectangle...

Security Bulletin: A vulnerability in Python affects PowerKVM

Summary PowerKVM is affected by a vulnerability in Python. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2014-9365 DESCRIPTION: Python could allow a remote attacker to bypass security restrictions, caused by the failure to validate TLS certificate by the HTTP librarie...

Security Bulletin: A vulnerability in NSS affects PowerKVM

Summary PowerKVM is affected by a vulnerability in Network Security Services NSS. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2017-7502 DESCRIPTION: Mozilla Network Security Services NSS, as used in Mozilla Firefox, is vulnerable to a denial of service, caused by a...

Security Bulletin: A vulnerability in ghostscript affects PowerKVM

Summary PowerKVM is affected by a vulnerability in ghostscript. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2017-8291 DESCRIPTION: Artifex Ghostscript could allow a remote attacker to execute arbitrary commands on the system. By using .rsdparams type confusion with ...