CVE-2023-45166

CVE-2023-45166 affects IBM AIX 7.2, 7.3 and VIOS 3.1. A non-privileged local user can exploit a vulnerability in the piodmgrsu command to obtain elevated privileges, enabling local privilege escalation. Red Hat and IBM advisories confirm the affected products and applicable APARs: IJ48481, IJ4878...

PT-2023-8370

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 through 7.3 VIOS version 3.1 Description The issue is related to insufficient input validation in the operating system, allowing a non-privileged local user to exploit a vulnerability in the piobe command. This could lead ...

PT-2023-8369

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 through 7.3 VIOS version 3.1 Description The issue is related to insufficient input validation, which can be exploited by a non-privileged local user to obtain elevated privileges using the piodmgrsu command. This can lead...

PT-2023-8368

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 through 7.3 VIOS version 3.1 Description The issue is related to insufficient access control in the operating system, allowing a privileged local user to exploit a vulnerability in the qdaemon command. This could lead to...

CVE-2023-45168

IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. IBM X-Force ID: 267966...

CVE-2023-45168

IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. IBM X-Force ID: 267966...

Design/Logic Flaw

IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. IBM X-Force ID: 267966...

CVE-2023-45168

Summary of CVE-2023-45168 (IBM AIX invscout): Affects IBM AIX versions 7.2 and 7.3 and VIOS 3.1. A local, non-privileged user can exploit a vulnerability in the invscout command to execute arbitrary commands. The vulnerability stems from the invscout component and has a high impact on confidentia...

Security Bulletin: AIX is vulnerable to arbitrary command execution due to invscout (CVE-2023-45168)

Summary A vulnerability in the AIX invscout command could allow a non-privileged local user to execute arbitrary commands CVE-2023-45168. Vulnerability Details CVEID:CVE-2023-45168 DESCRIPTION: IBM AIX could allow a non-privileged local user to exploit a vulnerability in the invscout command to...

AIX is vulnerable to arbitrary command execution due to invscout

IBM SECURITY ADVISORY First Issued: Thu Nov 30 10:49:53 CST 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/invscoutadvisory5.asc Security Bulletin: AIX is vulnerable to arbitrary command execution due to invscout CVE-2023-45168...

Security Bulletin: AIX is affected by a denial of service (CVE-2023-45167) and a security restrictions bypass (CVE-2023-40217) due to Python

Summary A vulnerability in Python could allow a non-privileged local user to cause a denial of service CVE-2023-45167 and a remote attacker to cause a security restrictions bypass CVE-2023-40217. Python is used by AIX as part of Ansible node management automation. Vulnerability Details...

Security Bulletin: AIX is vulnerable to a denial of service due to libxml2 (CVE-2022-29824)

Summary UPDATED Dec 12 2022 Added iFixes for AIX 7.2 TL5 SP5 and VIOS 3.1.4.10: A vulnerability in libxml2 could allow a remote attacker to cause a denial of service CVE-2022-29824. AIX uses libxml2 as part of its XML parsing functions. Vulnerability Details CVEID:CVE-2022-29824 DESCRIPTION: GNOM...

Security Bulletin: AIX is vulnerable to a denial of service due to NTP (CVE-2023-26551, CVE-2023-26552, CVE-2023-26553, CVE-2023-26554)

Summary Multiple vulnerabilities in NTP could allow a remote attacker to cause a denial of service CVE-2023-26551, CVE-2023-26552, CVE-2023-26553, CVE-2023-26554. Vulnerability Details CVEID:CVE-2023-26551 DESCRIPTION: NTP is vulnerable to a denial of service, caused by an out-of-bounds write in...

Security Bulletin: AIX is vulnerable to arbitrary command execution (CVE-2023-26286)

Summary A vulnerability in the AIX runtime services library could allow a non-privileged local user to execute arbitrary commands CVE-2023-26286. Vulnerability Details CVEID:CVE-2023-26286 DESCRIPTION: IBM AIX could allow a non-privileged local user to exploit a vulnerability in the AIX runtime...

Security Bulletin: AIX is vulnerable to denial of service due to ISC BIND (CVE-2023-2828)

Summary A vulnerability in ISC BIND could allow a remote attacker to cause a denial of service CVE-2023-2828. AIX uses ISC BIND as part of its DNS functions. Vulnerability Details CVEID:CVE-2023-2828 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by a flaw that allows the...

Multiple vulnerabilities in IBM Java SDK affect AIX

IBM SECURITY ADVISORY First Issued: Thu Aug 31 12:31:07 CDT 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/javaaug2023advisory.asc Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX...

CVE-2023-40371 IBM AIX information disclosure

IBM AIX 7.2, 7.3, VIOS 3.1's OpenSSH implementation could allow a non-privileged local user to access files outside of those allowed due to improper access controls. IBM X-Force ID: 263476...

CVE-2023-40371

CVE-2023-40371 affects IBM AIX 7.2, 7.3 and VIOS 3.1 via OpenSSH, allowing a non-privileged local user to access files outside allowed boundaries due to improper access controls. The IBM advisory (openssh_fix15) lists fixed interim packages: openssh.base (versions 8.1.102.2106 and 9.2.112.2000) w...

IBM AIX 安全漏洞

IBM AIX is an open standards-based UNIX operating system developed for the IBM Power architecture by International Business Machines IBM. A security vulnerability exists in IBM AIX that stems from an unauthorized file access issue in OpenSSH that allows unprivileged local users to access files...

Security Bulletin: AIX is vulnerable to unauthorized file access and arbitrary code execution due to OpenSSH (CVE-2023-40371 and CVE-2023-38408)

Summary Vulnerabilities in AIX's OpenSSH could allow a non-privileged local user file access outside of those allowed CVE-2023-40371 or allow a remote attacker to execute arbitrary code CVE-2023-38408. OpenSSH is used by AIX for remote login. Vulnerability Details CVEID:CVE-2023-40371 DESCRIPTION...