Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities

Summary There are vulnerabilities in Open-Source Software OSS components consumed by IBM Cognos Dashboards on Cloud Pak for Data. Please refer to the Related Information section below for vulnerability impact. This Security Bulletin relates only to the direct usage of third-party components by IB...

CVE-2024-42407

CVE-2024-42407 affects Gallagher Command Centre Server: the Alarm Transmitter feature can cause insertion of sensitive information into log files, enabling an authenticated Operator to view restricted data. Affected versions are Command Centre Server 9.10 before 9.10.2149 (MR4), 9.00 before 9.00....

SUSE SLES15 Security Update : kernel (Live Patch 39 for SLE 15 SP3) (SUSE-SU-2024:4179-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4179-1 advisory. This update for the Linux Kernel 5.3.18-15030059144 fixes several issues. The following security issues were fixed: - CVE-2024-36904: tcp: Use...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2024:4131-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4131-1 advisory. The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes. The following security bugs were fixed: -...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2024:4140-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4140-1 advisory. The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes. The following security bugs were fixed: -...

CVE-2024-47596

GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in the qtdemuxparsesvq3stsddata function within qtdemux.c. In the FOURCCSMI case, seqhsize is read from the input file without proper validation. If seqhsize is greater than the remaining...

SUSE SLES15 Security Update : kernel (Live Patch 44 for SLE 15 SP3) (SUSE-SU-2024:4180-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4180-1 advisory. This update for the Linux Kernel 5.3.18-15030059161 fixes several issues. The following security issues were fixed: - CVE-2024-36904: tcp: Use...

SUSE SLES15 Security Update : kernel RT (Live Patch 16 for SLE 15 SP5) (SUSE-SU-2024:4127-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4127-1 advisory. This update for the Linux Kernel 5.14.21-1505001358 fixes several issues. The following security issues were fixed: - CVE-2021-47517: Fix panic...

SUSE SLES15 Security Update : kernel RT (Live Patch 1 for SLE 15 SP6) (SUSE-SU-2024:4139-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4139-1 advisory. This update for the Linux Kernel 6.4.0-150600105 fixes several issues. The following security issues were fixed: - CVE-2024-43861: Fix memory...

SUSE SLES15 Security Update : kernel (Live Patch 38 for SLE 15 SP3) (SUSE-SU-2024:4177-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4177-1 advisory. This update for the Linux Kernel 5.3.18-15030059141 fixes several issues. The following security issues were fixed: - CVE-2024-36904: tcp: Use...

Windows Tooling Updates: OleView.NET

Posted by James Forshaw, Google Project Zero This is a short blog post about some recent improvements I've been making to the OleView.NET tool which has been released as part of version 1.16. The tool is designed to discover the attack surface of Windows COM and find security vulnerabilities such...

CVE-2024-47603

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gstmatroskademuxupdatetracks function within matroska-demux.c. The vulnerability occurs when the gstcapsisequal function is called with invalid caps...

Oracle Linux 9 : python3.9:3.9.21 (ELSA-2024-10983)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-10983 advisory. 3.9.21-1 - Update to 3.9.21 - Security fix for CVE-2024-11168 and CVE-2024-9287 Resolves: RHEL-64888 Resolves: RHEL-67259 Tenable has extracted the...

SUSE SLES15 Security Update : kernel RT (Live Patch 18 for SLE 15 SP5) (SUSE-SU-2024:4160-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4160-1 advisory. This update for the Linux Kernel 5.14.21-1505001364 fixes several issues. The following security issues were fixed: - CVE-2021-47517: Fix panic...

SUSE SLES15 Security Update : kernel RT (Live Patch 14 for SLE 15 SP5) (SUSE-SU-2024:4125-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4125-1 advisory. This update for the Linux Kernel 5.14.21-1505001352 fixes several issues. The following security issues were fixed: - CVE-2021-47517: Fix panic...

EulerOS 2.0 SP12 : lua (EulerOS-SA-2024-2939)

According to the versions of the lua package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal3,2^31.CVE-2020-24370...

SUSE SLES15 Security Update : kernel RT (Live Patch 8 for SLE 15 SP5) (SUSE-SU-2024:4120-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4120-1 advisory. This update for the Linux Kernel 5.14.21-1505001327 fixes several issues. The following security issues were fixed: - CVE-2021-47517: Fix panic...

Oracle Linux 8 : python3.12 (ELSA-2024-10980)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-10980 advisory. 3.12.8-1 - Update to 3.12.8 - Security fix for CVE-2024-9287 and CVE-2024-12254 Resolves: RHEL-64880, RHEL-70315 Tenable has extracted the preceding...

RHEL 9 : python3.12 (RHSA-2024:10978)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10978 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

SUSE SLES15 Security Update : kernel RT (Live Patch 11 for SLE 15 SP5) (SUSE-SU-2024:4123-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4123-1 advisory. This update for the Linux Kernel 5.14.21-1505001338 fixes several issues. The following security issues were fixed: - CVE-2021-47517: Fix panic...