Security Bulletin: IBM i Integrated Web Application Server version 8.5 is affected by multiple vulnerabilities.

Summary IBM i Integrated Web Application Server version 8.5 is affected by multiple security vulnerabilities. Vulnerability Details CVEID: CVE-2016-0385 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to bypass security restrictions caused by a buffer overflow. This...

Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM i

Summary OpenSSL is used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-3730 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. By sending specially crafted parameters for a DHE or ECDHE key exchange, a remote...

Security Bulletin: Vulnerabilities in OpenSSH affect IBM i (CVE-2016-1907, CVE-2016-1908, CVE-2016-3115)

Summary OpenSSH vulnerabilities affect IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-3115 DESCRIPTION: OpenSSH could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied X11...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM i.

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM i. Vulnerability Details CVEID: CVE-2016-0483 DESCRIPTION: An unspecified vulnerability in Oracle Java SE Java SE Embedded and Jrockit related to the AWT component has complete confidentiality...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM i

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered with this product, you should evaluat...

Security Bulletin: IBM i is affected by networking BIND vulnerabilities (CVE-2016-2775, CVE-2016-2776, CVE-2016-8864 and CVE-2016-6170)

Summary ISC BIND is vulnerable to several security vulnerabilities. IBM i has addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2016-2775 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by an error when lwresd or the named lwres option is enabled. By sending an...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM i

Summary OpenSSL vulnerabilities were disclosed on December 3, 2015 by the OpenSSL Project. OpenSSL is used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-3193 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an...

Security Bulletin: Multiple Vulnerabilities in OpenSSH affect IBM i

Summary OpenSSH is used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-10009 DESCRIPTION: OpenSSH could allow a remote authenticated attacker to execute arbitrary code on the system, caused by the loading of a specially crafted PKCS11 module across a...

Security Bulletin: IBM i is affected by CVE-2018-20685, CVE-2019-6111, and CVE-2019-6109 vulnerabilities in OpenSSH.

Summary OpenSSH is used by IBM i. IBM i has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2019-6109 DESCRIPTION: OpenSSH could allow a remote attacker to conduct spoofing attacks, caused by missing character encoding in the progress display. A man-in-the-middle attacke...

Security Bulletin: Vulnerability CVE-2017-9798 in the IBM i HTTP Server affects IBM i.

Summary HTTP Server is supported by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-9798 DESCRIPTION: Apache HTTP Server could allow a remote attacker to obtain sensitive information, caused by a flaw in the HTTP OPTIONS method, aka Optionsbleed. By sending a...

Security Bulletin: Vulnerability CVE-2018-11763 in the IBM i HTTP Server affects IBM i.

Summary HTTP Server is supported by IBM i. IBM i has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2018-11763 DESCRIPTION: Apache HTTP Server is vulnerable to a denial of service. By sending continuous overly large SETTINGS frames of maximum size to keep the ongoing HTTP/2...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM i

Summary OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM i. IBM i has addressed the applicable CVEs including the “DROWN: Decrypting RSA with Obsolete and Weakened eNcryption" vulnerability. Vulnerability Details CVEID: CVE-2016-0800...

Security Bulletin: IBM i is affected by networking BIND vulnerabilities (CVE-2017-3136, CVE-2017-3137 and CVE-2017-3138)

Summary ISC BIND is vulnerable to several security vulnerabilities. IBM i has addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2017-3138 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by an error related to the processing of control channel commands. By sendin...

Security Bulletin: Vulnerability CVE-2017-7494 in Samba affects IBM i

Summary Samba is supported on IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-7494 DESCRIPTION: Samba could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper access to named pipe endpoints. By uploading a...

Security Bulletin: Vulnerabilities CVE-2019-0196, CVE-2019-0197, and CVE-2019-0220 in the IBM i HTTP Server affect IBM i.

Summary HTTP Server is supported by IBM i. IBM i has addressed the applicable CVEs. This security bulletin has been updated, on August 8, 2019, as superseding IBM i PTFs are available for CVE-2019-0220 for IBM i 7.2, 7.3, and 7.4. This security bulletin has been updated, on June 21, 2019, as...

Security Bulletin: Vulnerabilities in Samba affect IBM i

Summary Security vulnerabilities in Samba affect IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-3223 DESCRIPTION: Samba is vulnerable to a denial of service, caused by an error in the daemon LDAP server. By sending specially crafted packets, an attacker coul...

Security Bulletin: IBM i is affected by several OpenSSL vulnerabilities.

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL is used by IBM i. IBM i has addressed the applicable CVEs provided by OpenSSL Vulnerability Details CVEID: CVE-2015-0207 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an implementation error in t...

Security Bulletin: IBM i is affected by networking BIND vulnerabilities.

Summary ISC BIND is vulnerable to several security vulnerabilities. Vulnerability Details CVEID: CVE-2015-8000 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by an error in db.c when parsing incoming responses. A remote attacker could exploit this vulnerability to trigger a...

Security Bulletin: IBM i is affected by networking BIND vulnerabilities CVE-2015-5477 and CVE-2015-4620.

Summary BM i is affected by several ISC BIND vulnerabilities. Vulnerability Details CVEID: CVE-2015-5477 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by an error in the handling of TKEY queries. By sending specially-crafted packets, a remote attacker could exploit this...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM i.

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM i. Vulnerability Details CVEID: CVE-2018-2579 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Libraries component could allow an...