CVE-2014-8904

lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCMDLQUERYLV environment-variable value...

AIX cmdlvm vulnerability,VIOS cmdlvm vulnerability

IBM SECURITY ADVISORY First Issued: Tue Jan 13 12:44:56 AM CST 2015 Updated: Tue Jan 20 08:37:23 CST 2015 Update: Added Acknowledgment Updated: Fri Jan 30 09:02:40 CST 2015 Update: Updated iFixes |Updated: Tue Feb 17 14:15:48 CST 2015 |Update: Updated 6.1.8 and 7.1.2 SPs The most recent version o...

Multiple vulnerabilities in current releases of the IBM SDK Java Technology Edition; issues in the Oracle October 2014 Critical Patch Update plus the POODLE SSLv3 vulnerability and

IBM SECURITY ADVISORY First Issued: Fri Nov 14 15:40:48 CST 2014 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/javaoct2014advisory.asc https://aix.software.ibm.com/aix/efixes/security/javaoct2014advisory.asc...

Open Source RSyslog vulnerability

IBM SECURITY ADVISORY First Issued: Fri Nov 14 03:31:13 PM CST 2014 | Updated: Mon Dec 01 10:21:50 AM CST 2014 | Update: Fileset name incorrect in lslpp command The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/rsyslogadvisory.asc...

Multiple Security vulnerabilities in IBM NAS

IBM SECURITY ADVISORY First Issued : Thu Aug 28 03:15:00 CDT 2014 | Updated: Fri Sep 5 01:11:34 CDT 2014 | Update: The same ifix with a packaging change has been added in | Update: "A. FIXES" section. The most recent version of this document is available here:...

Multiple vulnerabilities in current releases of the IBM SDK Java Technology Edition

IBM SECURITY ADVISORY First Issued: Mon Aug 18 14:04:26 CDT 2014 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/javajul2014advisory.asc https://aix.software.ibm.com/aix/efixes/security/javajul2014advisory.asc...

Vulnerability in AIX bind,Vulnerability in VIOS bind

IBM SECURITY ADVISORY First Issued: Fri Aug 15 14:07:52 CDT 2014 |Updated: Fri Aug 22 10:29:06 CDT 2014 |Update: VIOS fileset names updated The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/bind9advisory6.asc...

AIX libxml2 vulnerability,VIOS libxml2 vulnerability

IBM SECURITY ADVISORY First Issued: Fri Aug 15 10:26:30 CDT 2014 Updated: Fri Aug 22 08:17:41 CDT 2014 Update: fixed APAR availability dates |Update: Mon Aug 25 15:18:37 CDT 2014 |Update Corrected a couple Service Pack levels The most recent version of this document is available here:...

CVE-2014-3074

The runtime linker in IBM AIX 6.1 and 7.1 and VIOS 2.2.x allows local users to create a mode-666 root-owned file, and consequently gain privileges, by setting crafted MALLOCOPTIONS and MALLOCBUCKETS environment-variable values and then executing a setuid program...

Design/Logic Flaw

The runtime linker in IBM AIX 6.1 and 7.1 and VIOS 2.2.x allows local users to create a mode-666 root-owned file, and consequently gain privileges, by setting crafted MALLOCOPTIONS and MALLOCBUCKETS environment-variable values and then executing a setuid program...

CVE-2014-3074

The runtime linker in IBM AIX 6.1 and 7.1 and VIOS 2.2.x allows local users to create a mode-666 root-owned file, and consequently gain privileges, by setting crafted MALLOCOPTIONS and MALLOCBUCKETS environment-variable values and then executing a setuid program...

CVE-2014-3074

The CVE-2014-3074 incident affects IBM AIX 6.1/7.1 (and VIOS 2.2.x) where the runtime linker allows local privilege escalation by manipulating MALLOCOPTIONS/MALLOCBUCKETS and then running a setuid program to create a root-owned 666 file. The root cause is in the malloc subsystem used by the AIX r...

CVE-2014-3074

The runtime linker in IBM AIX 6.1 and 7.1 and VIOS 2.2.x allows local users to create a mode-666 root-owned file, and consequently gain privileges, by setting crafted MALLOCOPTIONS and MALLOCBUCKETS environment-variable values and then executing a setuid program. Recent assessments: timb-machine ...

AIX Malloc vulnerability,VIOS Malloc vulnerability

IBM SECURITY ADVISORY |Updated: Tue Mar 10 11:31:13 CDT 2015 |Update: Changed affected upper file set levels for 6.1.8 and | 7.1.2. The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/mallocadvisory.asc...

Multiple vulnerabilities in current releases of the IBM SDK Java Technology Edition

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 IBM SECURITY ADVISORY First Issued: Thu Jun 19 09:10:49 CDT 2014 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/javaapr2014advisory.asc...

Network Time Protocol (NTP) vulnerability in AIX,Network Time Protocol (NTP) vulnerability in VIOS

IBM SECURITY ADVISORY First Issued: Thu Jun 12 16:24:51 CDT 2014 Updated: Tue Jul 1 12:35:38 CDT 2014 Update: Corrected public key URL. Updated: Wed Jul 2 15:20:29 CDT 2014 Update: Added published advisory OpenSSL signature file. Updated: Thu Jul 3 07:42:49 CDT 2014 Update: Renamed tar file for T...

CVE-2014-3977

libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on a temporary file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2179...

Design/Logic Flaw

libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on a temporary file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2179...

CVE-2014-3977

CVE-2014-3977 affects IBM AIX 6.1, 7.1 and VIOS 2.2.x via libodm.a. Local users can overwrite arbitrary files through a symlink attack on a temporary file, due to an incomplete fix for CVE-2012-2179. This is a local-privilege context vulnerability stemming from the libodm implementation. Impact d...

CVE-2014-3977

libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on a temporary file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2179...