Security Bulletin: IBM NeXtScale Fan Power Controller (FPC) is affected by vulnerabilities in OpenSSL (CVE-2019-1547 and CVE-2019-1563)

Summary The following vulnerabilities in OpenSSL have been addressed by IBM NeXtScale Fan Power Controller FPC. Vulnerability Details CVEID: CVE-2019-1547 DESCRIPTION: OpenSSL could allow a local authenticated attacker to obtain sensitive information, caused by the ability to construct an EC grou...

CVE-2020-0077

In authorizeenroll of the FPC IRIS TrustZone app, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

CVE-2020-0076

In getauthresult of the FPC IRIS TrustZone app, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

CVE-2020-0075

In setsharedkey of the FPC IRIS TrustZone app, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

Out-of-bounds

In setsharedkey of the FPC IRIS TrustZone app, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

CVE-2020-0075

CVE-2020-0075 affects the FPC Iris TZ App within Android (FPC component). Description: out-of-bounds read due to a missing bounds check in set_shared_key, enabling local information disclosure with System privileges required; no user interaction needed. Mode: Normal (concrete details provided). C...

CVE-2020-0075

In setsharedkey of the FPC IRIS TrustZone app, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

CVE-2020-0076

CVE-2020-0076 affects the FPC Iris TZ App in Android. Description: an out-of-bounds write in get_auth_result due to a missing bounds check, enabling local elevation of privilege to System if exploited; exploitation does not require user interaction. Affected product/area: Android kernel component...

CVE-2020-0076

In getauthresult of the FPC IRIS TrustZone app, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

Juniper Networks Junos OS Input Validation Error Vulnerability (CNVD-2020-33671)

Juniper Networks Junos OS is a Juniper Networks network operating system for the company's hardware devices. The OS provides a secure programming interface and the Junos SDK. An input validation error vulnerability exists in Juniper Networks Junos OS 12.3X48. An attacker could exploit this...

CVE-2020-1638

The FPC Flexible PIC Concentrator of Juniper Networks Junos OS and Junos OS Evolved may restart after processing a specific IPv4 packet. Only packets destined to the device itself, successfully reaching the RE through existing edge and control plane filtering, will be able to cause the FPC restar...

Race condition

The FPC Flexible PIC Concentrator of Juniper Networks Junos OS and Junos OS Evolved may restart after processing a specific IPv4 packet. Only packets destined to the device itself, successfully reaching the RE through existing edge and control plane filtering, will be able to cause the FPC restar...

CVE-2020-1638 Junos OS & Junos OS Evolved: A specific IPv4 packet can lead to FPC restart.

The FPC Flexible PIC Concentrator of Juniper Networks Junos OS and Junos OS Evolved may restart after processing a specific IPv4 packet. Only packets destined to the device itself, successfully reaching the RE through existing edge and control plane filtering, will be able to cause the FPC restar...

CVE-2020-1638

The CVE-2020-1638 issue affects Juniper Junos OS and Junos OS Evolved FPCs in MX Series (MPC10E/MPC11E) and PTX10001/PTX10003 lines, where processing a specific IPv4 packet can trigger an FPC restart and drop all traffic via the FPC, causing a sustained DoS. Affected ranges include: Junos OS on M...

CVE-2020-1634 Junos OS: High-End SRX Series: Multicast traffic might cause all FPCs to reset.

On High-End SRX Series devices, in specific configurations and when specific networking events or operator actions occur, an SPC receiving genuine multicast traffic may core. Subsequently, all FPCs in a chassis may reset causing a Denial of Service. This issue affects both IPv4 and IPv6. This iss...

Google Android FPC Iris TZ App Out-of-Bounds Read Vulnerability

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA in the U.S. The FPC Iris TZ App is one of the iris recognition components. A security vulnerability exists in the FPC Iris TZ App in Android. The vulnerability can be exploited by an attacker to...

Android FPC elevation of privilege vulnerability (CNVD-2020-16079)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. There is a security vulnerability in FPC in Android. An attacker can exploit the vulnerability to elevate privileges...

Security Bulletin: IBM NeXtScale Fan Power Controller (FPC) is affected by vulnerability in OpenSSL (CVE-2019-1559)

Summary IBM NeXtScale Fan Power Controller FPC has addressed the following vulnerability in OpenSSL. Vulnerability Details CVEID: CVE-2019-1559 DESCRIPTION: If an application encounters a fatal protocol error and then calls SSLshutdown twice once to send a closenotify, and once to receive one the...

CVE-2019-0075

A vulnerability in the srxpfe process on Protocol Independent Multicast PIM enabled SRX series devices may lead to crash of the srxpfe process and an FPC reboot while processing PIM messages. Sustained receipt of these packets may lead to an extended denial of service condition. Affected releases...

CVE-2019-0075

A vulnerability in the srxpfe process on Protocol Independent Multicast PIM enabled SRX series devices may lead to crash of the srxpfe process and an FPC reboot while processing PIM messages. Sustained receipt of these packets may lead to an extended denial of service condition. Affected releases...