Security Bulletin: IBM Java SDK and IBM Java Runtime for IBM i are vulnerable to arbitrary code execution due to an unsafe deserialization flaw (CVE-2022-40609).

Summary IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ used by IBM i are vulnerable to an attacker executing arbitrary code due to an unsafe deserialization flaw as described in the vulnerability details section. The vulnerability is fixed by applying an IBM i Group PTF for...

Security Bulletin: ISC BIND on IBM i is vulnerable to denial of service due to a memory usage flaw (CVE-2023-2828)

Summary Domain Name System DNS uses ISC BIND. ISC BIND on IBM i is vulnerable to a denial of service attack due to memory usage exceeding the configured cache size limit as seen in the vulnerability details section. IBM i has addressed the vulnerability in ISC BIND with a fix as described in the...

Security Bulletin: IBM Java SDK and IBM Java Runtime for IBM i are vulnerable to denial of service, availability, integrity, and confidentiality impacts due to multiple vulnerabilities.

Summary IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ used by IBM i are vulnerable to denial of service, availability, integrity, and confidentiality impacts as described in the vulnerability details section CVE-2022-21426, CVE-2023-2597, CVE-2023-21830, CVE-2023-21843,...

Security Bulletin: IBM Facsimile Support for i is vulnerable to local privilege escalation (CVE-2023-38721)

Summary IBM Facsimile Support for i is vulnerable to local privilege escalation as described in the vulnerability details section. IBM Facsimile Support for i has addressed the vulnerability as described in the remediation/fixes section. Vulnerability Details CVEID:CVE-2023-38721 DESCRIPTION: The...

Security Bulletin: IBM Facsimile Support for i is vulnerable to local privilege escalation (CVE-2023-30988)

Summary IBM Facsimile Support for i is vulnerable to local privilege escalation as described in the vulnerability details section. IBM Facsimile Support for i has addressed the vulnerability as described in the remediation/fixes section. Vulnerability Details CVEID:CVE-2023-30988 DESCRIPTION: The...

Security Bulletin: IBM Performance Tools for i is vulnerable to local privilege escalation (CVE-2023-30989)

Summary IBM Performance Tools for i is vulnerable to local privilege escalation as described in the vulnerability details section. IBM Performance Tools for i has addressed the vulnerability as described in the remediation/fixes section. Vulnerability Details CVEID:CVE-2023-30989 DESCRIPTION: IBM...

Security Bulletin: IBM i is vulnerable to an attacker executing CL commands due to an exploitation of DDM architecture (CVE-2023-30990)

Summary IBM i is vulnerable to a remote attacker executing CL commands due to an exploitation of DDM architecture as described in the vulnerability details section. IBM i has addressed the vulnerability in the DDM architecture as described in the remediation/fixes section. Vulnerability Details...

Security Bulletin: IBM Java SDK and IBM Java Runtime for IBM i are vulnerable to exposing sensitive information due to flaws and configurations (CVE-2023-30441).

Summary IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ used by IBM i are vulnerable to exposing sensitive information using a combination of flaws and configurations as described in the vulnerability details section. The vulnerability is fixed by applying an IBM i Group PTF...

Security Bulletin: IBM i is vulnerable to an authenticated administrator gaining elevated privileges due to improper SQL processing. (CVE-2023-23470)

Summary IBM i is vulnerable to an authenticated administrator gaining elevated privileges due to improper SQL processing as described in the vulnerability details section. IBM i has addressed the vulnerability in the SQL processing as described in the remediation/fixes section. Vulnerability...

Security Bulletin: IBM WebSphere Application Server Liberty for IBM i is vulnerable to a server-side request forgery, a denial of service, an attacker obtaining sensitive information, and gaining elevated privileges due to multiple vulnerabilities.

Summary IBM WebSphere Application Server for IBM i is vulnerable to a server-side request forgery due to a flaw in parsing the href attribute CVE-2022-46364, and is affected by an attacker obtaining sensitive information due to improper permissions on a temporary file CVE-2022-45787, attacker...

Security Bulletin: IBM HTTP Server (powered by Apache) for IBM i is vulnerable to HTTP response splitting and denial of service attacks (CVE-2022-37436, CVE-2006-20001)

Summary IBM HTTP Server powered by Apache for IBM i is vulnerable to HTTP response splitting attacks due to a use of malicious backend and a denial of service attack due to an out-of-bounds read or write as described in the vulnerability details section. IBM i has addressed the CVEs by providing...

Security Bulletin: IBM i DNS is affected by denial of service attacks due to flaws in ISC BIND (CVE-2022-3094, CVE-2022-3736, CVE-2022-3924).

Summary The IBM i DNS Server implementation uses ISC BIND. ISC BIND is vulnerable to denial of service attacks due to allocating memory before checking access permissions and flaws in the implementation of the stale-answer-client-timeout option as described in the vulnerability details section. I...

Security Bulletin: IBM Navigator for i and IBM Digital Certificate Manager for i are vulnerable to attacker obtaining sensitive information due to Java string processing in IBM Toolbox for Java (CVE-2022-43928).

Summary IBM Navigator for i and IBM Digital Certificate Manager for i use the IBM Toolbox for Java to access IBM i interfaces. IBM Toolbox for Java could allow sensitive information stored as Java strings to be obtained by an attacker as described in the vulnerability details section. IBM Navigat...

Security bulletin: Authentication bypass vulnerability in IBM SAN Volume Controller and Storwize Family (CVE-2012-6354)

Problem Security bulletin: Authentication bypass vulnerability in IBM SAN Volume Controller and Storwize Family CVE-2012-6354 Resolving The Problem Security Bulletin --- Summary --- Administrative access to the system via the GUI may be obtained without supplying proper credentials. Vulnerability...

Security Bulletin: IBM Navigator for i is vulnerable to log file access, obtaining file attributes, and SQL Injection attacks due to multiple vulnerabilities.

Summary IBM Navigator for i provides server administration functionality for IBM i. An authenticated user with authority to interact with IBM Navigator for i is able to download log files, view file attributes, and perform SQL injection attacks as described in the vulnerability details section. I...

Security Bulletin: IBM Java SDK and IBM Java Runtime for IBM i are vulnerable to bypassing security restrictions, denial of service attacks, and data integrity impacts due to multiple vulnerabilities.

Summary IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ used by IBM i are vulnerable to bypassing security restrictions, denial of service attacks, and allowing an unauthenticated attacker to modify data as seen in the vulnerability details section CVE-2022-3676,...

Security Bulletin: ISC DHCP server for IBM i is vulnerable to a denial of service attack due to a memory leak and refererence count overflow (CVE-2022-2928, CVE-2022-2929)

Summary ISC DHCP server on IBM i is vulnerable to a denial of service attack due to a memory leak in the fqdnuniversedecode function and a reference count overflow in the addoption function as described in the vulnerability details section. IBM i has addressed the vulnerabilities in ISC DHCP serv...

Security Bulletin: ISC BIND on IBM i is vulnerable to denial of service due to memory leaks and a flaw in resolver code (CVE-2022-2795, CVE-2022-38177, CVE-2022-38178)

Summary ISC BIND on IBM i is vulnerable to a denial of service attack due to memory leaks in the DNSSEC verification code and a flaw in resolver code to degrade performance as described in the vulnerability details section. IBM i has addressed the vulnerabilities in ISC BIND with a fix as describ...

Security Bulletin: Digital Certificate Manager for IBM i is vulnerable to cross-site scripting (CVE-2022-34358)

Summary Digital Certificate Manager for IBM i is vulnerable to a cross-site scripting issue in the old web application as described in the vulnerability details section. IBM i has addressed the applicable CVE with a fix to the Digital Certificate Manage web application as described in the...

Security Bulletin: Zlib for IBM i is vulnerable to a buffer overflow issue during inflate (CVE-2022-37434)

Summary Zlib for IBM i is vulnerable to a heap-based buffer overflow during inflate as described in the vulnerability details section. IBM i has addressed the vulnerability in Zlib with a fix as described in the remediation/fixes section. Vulnerability Details CVEID:CVE-2022-37434 DESCRIPTION: zl...