Security Bulletin: A vulnerability in rpcbind affects PowerKVM

Summary PowerKVM is affected by a vulnerability in rpcbind. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2017-8779 DESCRIPTION: rpcbind, LIBTIRPC, and NTIRPC are vulnerable to a denial of service, caused by improper validation of XDR strings in memory allocation. By...

Security Bulletin: A vulnerability in libtirpc affects PowerKVM

Summary PowerKVM is affected by a vulnerability in libtirpc. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2017-8779 DESCRIPTION: rpcbind, LIBTIRPC, and NTIRPC are vulnerable to a denial of service, caused by improper validation of XDR strings in memory allocation. By...

Security Bulletin: Tivoli Management Framework is affected by the following OpenSSL vulnerabilities: CVE-2014-3508 CVE-2014-5139 CVE-2014-3509 CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3510 CVE-2014-3511 CVE-2014-3512 CVE-2014-3513 CVE-2014-3566 (POODLE Attack) CVE-2014-3567 CVE-2014-3568.

Summary Tivoli Management Framework is affected by the following OpenSSL vulnerabilities: CVE-2014-3508 CVE-2014-5139 CVE-2014-3509 CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3510 CVE-2014-3511 CVE-2014-3512 CVE-2014-3513 CVE-2014-3566 POODLE Attack CVE-2014-3567 CVE-2014-3568...

Security Bulletin: Vulnerability in XDR affects IBM DataPower Gateways (CVE-2017-8804)

Summary A potential Denial of Service vulnerability exists in XDR. IBM DataPower Gateways has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-8804 DESCRIPTION: glibc is vulnerable to a denial of service, caused by improper handling of buffer deserialization in the xdrbytes and...

Security Bulletin: A vulnerability in SSH affects IBM DataPower Gateways (CVE-2016-8858)

Summary An SSH vulnerability was disclosed by the OpenSSH Project. IBM DataPower Gateways has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2016-8858 DESCRIPTION: OpenSSH is vulnerable to a denial of service, caused by an error in the kexinputkexinit function. By sending speciall...

CVE-2018-7164

Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by...

CVE-2018-7164

Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by...

Design/Logic Flaw

Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by...

CVE-2018-7164

Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by...

CVE-2018-7164

Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by...

CVE-2018-7164

CVE-2018-7164 affects Node.js 9.7.0+ and 10.x. The issue is a memory-exhaustion vulnerability introduced when reading from the network into JavaScript via the net.Socket object used as a stream, enabling a denial of service by sending tiny chunks in rapid succession. The behavior was reverted to ...

CVE-2018-7164

Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by...

CVE-2018-7164

Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by...

Denial Of Service (DoS)

libgd.so is vulnerable to denial of service DoS attacks. A malicious user can pass an oversized image to the gdImageCreate function in gd.c to consume memory and crash the application...

PT-2018-17924

Name of the Vulnerable Software and Affected Versions Node.js versions 9.7.0 and later Node.js versions 10.x Description A bug in Node.js increases memory consumption when reading from the network into JavaScript using the net.Socket object directly as a stream. This can be exploited by an attack...

CVE-2017-16129

The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive...

PT-2018-6157

Name of the Vulnerable Software and Affected Versions: superagent versions prior to 3.7.0 Description: The HTTP client module superagent is vulnerable to ZIP bomb attacks. In such an attack, an HTTP server replies with a compressed response that becomes significantly larger once uncompressed. If...

CVE-2018-1456: Improper Restriction of XML External Entity Reference

IBM Rhapsody DM 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 140091...

MGASA-2018-0266 Updated wireshark packages fix security vulnerabilities

Updated wireshark packages fix security vulnerabilities: The DNS dissector could crash CVE-2018-11356. Multiple dissectors could consume excessive memory CVE-2018-11357. The Q.931 dissector could crash CVE-2018-11358. Multiple dissectors could crash CVE-2018-11359. The GSM A DTAP dissector could...

openSUSE Security Update : opencv (openSUSE-2018-492)

This update for opencv fixes the following issues : Security issues fixed : - CVE-2016-1516: OpenCV had a double free issue that allowed attackers to execute arbitrary code. boo1033152 - CVE-2017-14136: OpenCV had an out-of-bounds write error in the function FillColorRow1 in utils.cpp when readin...