Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs

Summary Multiple vulnerabilities were fixed in IBM Cloud Pak for Watson AIOps version 3.6.1 Vulnerability Details CVEID:CVE-2022-40674 DESCRIPTION: libexpat could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in the doContent function in xmlparse.c. A...

AlmaLinux 9 : expat (ALSA-2023:0337)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:0337 advisory. - In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XMLExternalEntityParserCreate in out-of-memory situations...

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20220304.10013)

The version of AHV installed on the remote host is prior to 20220304.10013. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20220304.10013 advisory. - In Expat aka libexpat before 2.4.5, there is an integer overflow in storeRawNames. CVE-2022-25315 - In Expat...

AlmaLinux 8 : expat (ALSA-2023:0103)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:0103 advisory. - In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XMLExternalEntityParserCreate in out-of-memory situations...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in libexpat (CVE-2022-25313)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service caused by a stack exhaustion in the buildmodel component of libexpat CVE-2022-25313. Libexpat is used as part of the base image included in our service components. Please read the details...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in libexpat (CVE-2022-25314).

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution caused by a buffer overflow in libexpat CVE-2022-25314. Libexpat is used as part of the base image included in our service components. Please read the details for remediation below...

EulerOS Virtualization 2.9.1 : expat (EulerOS-SA-2023-1190)

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. CVE-2022-40674 Note that Tenable Network Securi...

EulerOS Virtualization 2.10.0 : expat (EulerOS-SA-2023-1166)

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. CVE-2022-40674 Note that Tenable Network Securi...

Huawei EulerOS: Security Advisory for expat (EulerOS-SA-2023-1008)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for expat (EulerOS-SA-2023-1033)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.

Summary Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak. Apache Commons is used by IBM Robotic Process Automation as part of the Watson NLP functionality CVE-2022-42889. Connect2id Nimbus JOSE+JWT is used by IBM Robotic Process Automation as part of the...

EulerOS Virtualization 3.0.2.6 : expat (EulerOS-SA-2023-1060)

According to the versions of the expat packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In Expat aka libexpat before 2.4.3, a left shift by 29 or more places in the storeAtts function in xmlparse.c can lead to realloc...

Security Bulletin: IBM Tivoli Monitoring is vulnerable to remote code execution [CVE-2022-40674]

Summary The libexpart parser that is used by IBM Tivoli Monitoring for parsing various configuration xml files and parsing soap requests is potentially vulnerable to remote code execution CVE-2022-40674. Vulnerability Details CVEID:CVE-2022-40674 DESCRIPTION: libexpat could allow a remote attacke...

Security Bulletin: Multiple vulnerabilities affect IBM Tivoli Monitoring included WebSphere Application Server and IBM HTTP Server used by WebSphere Application Server

Summary The following security issues have been identified in the WebSphere Application Server included as part of IBM Tivoli Monitoring ITM portal server. CVEs: CVE-2021-23450, CVE-2022-22719, CVE-2022-22720, CVE-2022-22721, CVE-2022-25315, CVE-2022-25313, CVE-2022-25235, CVE-2022-25236,...

Fedora 35 : expat (2022-c68d90efc3)

The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-c68d90efc3 advisory. Rebase to 2.4.9 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Fedora 36 : mingw-expat (2022-d93b3bd8b9)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-d93b3bd8b9 advisory. Update to 2.4.9, fixes CVE-2022-30674. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Security Bulletin: AIX is affected by a denial of service (CVE-2022-43680) due to Python

Summary A vulnerability in Python could allow a remote attacker to cause a denial of service CVE-2022-43680. Python is used by AIX as part of Ansible node management automation. Vulnerability Details CVEID:CVE-2022-43680 DESCRIPTION: libexpat is vulnerable to a denial of service, caused by a...

AIX is affected by a denial of service due to Python

IBM SECURITY ADVISORY First Issued: Thu Dec 22 10:15:28 CST 2022 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/pythonadvisory3.asc https://aix.software.ibm.com/aix/efixes/security/pythonadvisory3.asc...

Fedora 35 : mingw-pixman (2022-ae2559a8f4)

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-ae2559a8f4 advisory. Update to 0.42.2, fixes CVE-2022-44638 and CVE-2022-43680. Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 35 : mingw-expat (2022-c22feb71ba)

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-c22feb71ba advisory. Update to 2.4.9, fixes CVE-2022-30674. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...