Security Bulletin: IBM i affected by OpenSSL vulnerability (CVE-2014-0076)

Summary OpenSSL could allow a local attacker to obtain sensitive information, caused by an implementation error in ECDSA Elliptic Curve Digital Signature Algorithm. Vulnerability Details CVE IDs: CVE-2014-0076 DESCRIPTION: This bulletin covers the following OpenSSL related CVE. CVEID: CVE-2014-00...

Security Bulletin: Vulnerabilities CVE-2016-5387 and CVE-2016-5388 in IBM i HTTP Server

Summary HTTP Server is supported by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-5388 DESCRIPTION: Apache Tomcat could allow a remote attacker to redirect HTTP traffic of CGI application, caused by the failure to protect applications from the presence of...

Security Bulletin: IBM i is affected by CVE-2018-20685, CVE-2019-6111, and CVE-2019-6109 vulnerabilities in OpenSSH.

Summary OpenSSH is used by IBM i. IBM i has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2019-6109 DESCRIPTION: OpenSSH could allow a remote attacker to conduct spoofing attacks, caused by missing character encoding in the progress display. A man-in-the-middle attacke...

Security Bulletin: Vulnerabilities CVE-2017-12150, CVE-2017-12151 and CVE-2017-12163 in Samba affect IBM i

Summary Samba is supported on IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-12163 DESCRIPTION: Samba could allow a remote authenticated attacker to obtain sensitive information, caused by a memory leak over SMB1. By sending specially crafted SMB1 data, an...

Security Bulletin: Vulnerabilities in OpenSSH affect IBM i (CVE-2016-0777, CVE-2016-0778).

Summary An information leak flaw and buffer overflow flaw in the way the OpenSSH client roaming feature was implemented affects IBM i. Vulnerability Details CVEID: CVE-2016-0777 DESCRIPTION: OpenSSH could allow a remote attacker to obtain sensitive information, caused by a client information leak...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM i (CVE-2016-0701, CVE-2015-3197)

Summary OpenSSL vulnerabilities affect IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-0701 DESCRIPTION: OpenSSL could allow a remote attacker to conduct man-in-the-middle attacks, caused by the use of weak Diffie-Hellman parameters based on unsafe primes tha...

Security Bulletin: IBM i is affected by networking BIND vulnerabilities (CVE-2017-3142 and CVE-2017-3143)

Summary ISC BIND is vulnerable to several security vulnerabilities. IBM i has addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2017-3142 DESCRIPTION: ISC BIND could allow a remote attacker to bypass security restrictions, caused by an error when an attacker can send and receive...

Security Bulletin: Vulnerabilities CVE-2019-0196, CVE-2019-0197, and CVE-2019-0220 in the IBM i HTTP Server affect IBM i.

Summary HTTP Server is supported by IBM i. IBM i has addressed the applicable CVEs. This security bulletin has been updated, on August 8, 2019, as superseding IBM i PTFs are available for CVE-2019-0220 for IBM i 7.2, 7.3, and 7.4. This security bulletin has been updated, on June 21, 2019, as...

Security Bulletin: Multiple Vulnerabilities in Samba affect IBM i

Summary Samba is supported on IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-10918 DESCRIPTION: Samba is vulnerable to a denial of service, caused by a NULL pointer dereference when checking database outputs from the LDB database layer. If Samba is in an...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM i (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM i. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey a DHEEXPOR...

Security Bulletin: Multiple Vulnerabilities in Samba affect IBM i

Summary Samba is supported on IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-15275 DESCRIPTION: Samba could allow a remote attacker to obtain sensitive information, caused by a heap memory information leak. By sending a specially crafted request, an attacker...

Security Bulletin: IBM i is affected by networking BIND vulnerabilities (CVE-2016-9131, CVE-2016-9444, CVE-2016-9147, CVE-2016-9778 and CVE-2017-3135)

Summary ISC BIND is vulnerable to several security vulnerabilities. IBM i has addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2016-9778 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by the improper handling of specific queries when using the nxdomain-redirec...

Security Bulletin: IBM i is affected by networking BIND vulnerabilities

Summary ISC BIND is vulnerable to several security vulnerabilities. Vulnerability Details CVEID: CVE-2016-1286 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by an error when parsing signature records for DNAME resource records. A remote attacker could exploit this vulnerabili...

Security Bulletin: Vulnerability CVE-2019-1559 in OpenSSL affects IBM i

Summary OpenSSL is used by IBM i. IBM i has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-1559 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after the hosts encounter a...

Security Bulletin: IBM i is affected by DHCP vulnerabilities (CVE-2015-8605 and CVE-2016-2774).

Summary IBM i DHCP is vulnerable to several security vulnerabilities. Vulnerability Details CVEID: CVE-2015-8605 DESCRIPTION: ISC DHCP is vulnerable to a denial of service, caused by the failure to properly check the UDP payload length. By sending a specially crafted packet with an invalid IPv4 U...

Security Bulletin: Vulnerability in OSPFv2 Routing Protocol Used in IBM i Operating System (CVE-2013-0149 and CVE-2013-5385)

Problem : The OSPFv2 routing protocol specified in RFC 2328 has an ambiguity that can be exploited and allow for traffic to be black-holed and/or redirected. A PTF is provided. Resolving The Problem VULNERABILITY DETAILS: DESCRIPTION: A potential protocol vulnerability has been identified in the...

Security Bulletin: Vulnerability CVE-2017-7494 in Samba affects IBM i

Summary Samba is supported on IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-7494 DESCRIPTION: Samba could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper access to named pipe endpoints. By uploading a...

Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM i

Summary OpenSSL is used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-0739 DESCRIPTION: OpenSSL is vulnerable to a denial of service. By sending specially crafted ASN.1 data with a recursive definition, a remote attacker could exploit this vulnerability ...

Security Bulletin: Vulnerability CVE-2017-15906 in OpenSSH affects IBM i

Summary OpenSSH is used by IBM i. IBM i has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-15906 DESCRIPTION: OpenSSH is vulnerable to a denial of service, caused by an error in the processopen function when in read-only mode. A remote authenticated attacker could exploit thi...

Security Bulletin: Vulnerability in OpenSSH affects IBM i (CVE-2016-8858)

Summary OpenSSH vulnerability affects IBM i. IBM i has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2016-8858 DESCRIPTION: OpenSSH is vulnerable to a denial of service, caused by an error in the kexinputkexinit function. By sending specially crafted data during the key exchange...