Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: use after free in eventpoll.c may lead to escalation of privilege CVE-2020-0466 kernel: SCSI target LIO write to any block on ILO backstore CVE-2020-28374 kernel: Use after free via PI...

Security Bulletin: IBM DataQuant is vulnerable to CVE-2020-14803

Summary CVE-2020-14803 is an unspecified vulnerability in Java SE could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors. Vulnerability Details CVEID: CVE-2020-14803 DESCRIPTION: An unspecified vulnerability i...

Security Bulletin: IBM DataQuant is vulnerable to CVE-2020-14782

Summary IBM DataQuant is vulnerable to CVE-2020-14782, an unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. Vulnerability Details CVEID: CVE-2020-147...

Security Bulletin: Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE

Summary Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ dot dot backslash in a response to a recursive GET command. Vulnerability Details CVEID: CVE-2016-5725...

CGI Script Market Magazine Gar Z 跨站脚本漏洞

CGI Script Market Magazine Gar Z is a CGI Script Market open source application. A CGI script that provides e-mail press release distribution capabilities for Web sites. A security vulnerability exists in Magazinger Z v.1.01, which originates from an arbitrary script that can be executed on a web...

Security Bulletin: Rational Asset Analyzer is affected by a vulnerability in WebSphere Application Server Liberty (CVE-2020-10693)

Summary Rational Asset Analyzer team has addressed the following vulnerability: CVE-2020-10693. Vulnerability Details CVEID: CVE-2020-10693 DESCRIPTION: Hibernate Hibernate Validator could allow a remote attacker to bypass security restrictions, caused by a flaw in the message interpolation...

Security Bulletin: Vulnerabilities in IBM Java affecting IBM Rational asset analyzer.

Summary Multiple vulnerabilities are identified in IBM® SDK Java™ Technology Edition Version 1.8 that is used by IBM Rational Asset Analyzer. These issues were disclosed as part of the IBM Java SDK updates in July 2020. Vulnerability Details CVEID: CVE-2020-14579 DESCRIPTION: An unspecified...

Security Bulletin: Rational Asset Analyzer is affected by a vulnerability in WebSphere Application Server Liberty (CVE-2020-4643)

Summary Rational Asset Analyzer team has addressed the following vulnerability: CVE-2020-10693. Vulnerability Details CVEID: CVE-2020-4643 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A...

Moderate: Red Hat Security Advisory: Red Hat Certificate System security and bug fix update

An update for pki-console, pki-core, and redhat-pki-theme is now available for Red Hat Certificate System 9.4 EUS. Red Hat Certificate System 9.4 EUS is a special channel for the delivery of Red Hat Certificate System updates. Downgrading the installed packages is not supported. Red Hat Product...

Vulnerability of the utils.c:checkmailpath command in the UNIX shell Zsh: This vulnerability involves allowing an operation to exceed the permissible data buffer size. This allows a malicious actor to access confidential data, compromise its integrity, and cause service failures.

The vulnerability in the utils.c:checkmailpath command of the UNIX shell Zsh involves allowing the execution of commands beyond the data buffer’s allowed limits. Exploiting this vulnerability could allow an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the setuid function in the UNIX command shell Zsh allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failure.

The vulnerability of the setuid function in the UNIX command shell Zsh is related to incorrect reallocation of the user ID. Exploitation of this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the UNIX command-line shell script processor Zsh, related to the lack of input validation mechanisms, allows attackers to access sensitive data, compromise its integrity, and cause service failures.

The vulnerability of the UNIX command-line shell script processor Zsh is related to the improper handling of scripts containing !. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

Security Bulletin: z/TPF is affected by OpenSSL vulnerabilities

Summary The z/TPF version of OpenSSL was updated to address the vulnerabilities described by CVE-2021-23840 and CVE-2021-23841. Vulnerability Details CVEID: CVE-2021-23840 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an integer overflow in CipherUpdate. By sending an overl...

IBM DB2 Buffer Overflow Vulnerability (CNVD-2021-17192)

IBM DB2 is a set of relational database management system from IBM in the United States. The main execution environments for this system are UNIX, Linux, IBMi, z/OS, and Windows server versions. IBM DB2 has a security vulnerability that can be exploited by an attacker to trigger a denial of servi...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

microcode_ctl bug fix and enhancement update

The microcodectl packages provide microcode updates for Intel and AMD processors. Bug Fixes and Enhancements: rhel-8.3.0.z HPEMC 8.3.z REGRESSION Regression in intel microcode as of 20201110 BZ1907898...

nmstate bug fix and enhancement update

Nmstate is a library with an accompanying command line tool that manages host networking settings in a declarative manner. Bug Fixes and Enhancements: Only a default gw is supported per device BZ1910193 SR-IOV i40e After setting SR-IOV number of VFs, nmstate reports success before VFs links are...

Security Bulletin: A security vulnerability has been identified in IBM Java Runtime which affects DataQuant for z/OS

Summary An unspecified vulnerability has been identified in IBM Java Runtime that could affect DataQuant for z/OS. Vulnerability Details CVEID: CVE-2018-12547 CVSS Base Score: 9.8 DESCRIPTION: A widely used function in the OpenJ9 JVM is vulnerable to buffer overlows. Multiple Java Runtime...

Security Bulletin: A security vulnerability has been identified in Apache PDFBox which affects DataQuant

Summary A security vulnerability has been identified in Apache PDFBox that could affect DataQuant for z/OS and DataQuant Multiplatforms. Vulnerability Details CVEID: 2018-11797 CVS Score: 5.5 Description: Apache PDFBox is vulnerable to a denial of service, caused by a flaw when parsing the page...

Security Bulletin: A security vulnerability in IBM SDK which affects DataQuant for z/OS (CVE-2019-2816, CVE-2019-2766, CVE-2019-11771, CVE-2019-11775, CVE-2019-2786, CVE-2019-11772, CVE-2019-2769, CVE-2019-2762, CVE-2019-7317, CVE-2019-4473)

Summary A security vulnerability has been identified in IBM SDK that could affect DataQuant for z/OS. Vulnerability Details CVEID: CVE-2019-2816 CVSS Base Score: 4.8 DESCRIPTION: A flaw in the java.net API incorrectly converts some Unicode characters when converting Internalized Domain Name URLs...