Security Bulletin: Vulnerabilities in open source zlib library affect IBM Data Server Driver Package and IBM Data Server Driver for ODBC and CLI

Summary Vulnerabilities have been addressed in the open source zlib library component of IBM Data Server Driver Package and IBM Data Server Driver for ODBC and CLI. Vulnerability Details CVEID: CVE-2016-9840 DESCRIPTION: zlib is vulnerable to a denial of service, caused by an out-of-bounds pointe...

Security Bulletin: Mutiple vulnerabilities in zlib affect IBM ILOG CPLEX Optimization Studio

Summary The gz feature, provided by the open source zlib, is used to decompress files automatically. A denial of service may be caused by four potential vulnerabilities. Vulnerability Details CVEID: CVE-2016-9840 DESCRIPTION: zlib is vulnerable to a denial of service, caused by an out-of-bounds...

Security Bulletin: Multiple vulnerabilities in IBM® Java Runtime affect IBM Cognos Command Center

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 that is used by IBM Cognos Command Center. These issues were disclosed as part of the IBM Java SDK updates in April 2017. Vulnerability Details CVEID: CVE-2017-3544 DESCRIPTION: An unspecifi...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos Metrics Manager

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 6 and 7 used by IBM Cognos Metrics Manager. These issues were disclosed as part of the IBM Java SDK updates in Apr 2017. Vulnerability Details CVEID: CVE-2017-3544 DESCRIPTION: An unspecified vulnerability relat...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK that affect IBM PureApplication System

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 and 7, used by the OS Images for IBM PureApplication System. These issues were disclosed as part of the IBM Java SDK updates in Oct 2017. Vulnerability Details CVEID: CVE-2016-9841 DESCRIPTION: zlib is...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Support Assistant Team Server

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8.0 used by IBM Support Assistant Team Server. These issues were disclosed as part of the IBM Java SDK updates in Apr 2017. Vulnerability Details If you run your own Java code using the IBM Java Runtime deliver...

Node.js Foundation Node.js zlib windowBits Denial of Service (CVE-2017-14919)

A denial of service vulnerability exists in Node.js. The vulnerability is due to a newer version of zlib that does not permit a value of 8 for windowBits, and crashes or throws an exception when passed said value...

PYSEC-2018-126

In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an attempt at memory allocation for an Exiv2::Internal::PngChunk::zlibUncompress call...

DEBIAN-CVE-2018-10958

In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an attempt at memory allocation for an Exiv2::Internal::PngChunk::zlibUncompress call...

PYSEC-2018-126

In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an attempt at memory allocation for an Exiv2::Internal::PngChunk::zlibUncompress call...

PT-2022-2042

Name of the Vulnerable Software and Affected Versions zlib versions 1.2.11 through 1.2.12 Description The issue is related to memory corruption when deflating, i.e., when compressing, if the input has many distant matches. This can lead to a buffer overflow in memory. An attacker could potentiall...

[SECURITY] Fedora 27 Update: zziplib-0.13.68-1.fc27

The zziplib library is intentionally lightweight, it offers the ability to easily extract data from files archived in a single zip file. Applications can bundle files into a single zip archive and access them. The implementat ion is based only on the free subset of compression with the zlib...

[SECURITY] Fedora 27 Update: zziplib-0.13.67-1.fc27

The zziplib library is intentionally lightweight, it offers the ability to easily extract data from files archived in a single zip file. Applications can bundle files into a single zip archive and access them. The implementat ion is based only on the free subset of compression with the zlib...

SUSE-SU-2018:0293-1 Security update for nodejs6

This update for nodejs6 fixes the following issues: Security issues fixed: - CVE-2017-15896: Vulnerable to CVE-2017-3737 due to embedded OpenSSL bsc1072322. - CVE-2017-14919: Embedded zlib issue could cause a DoS via specific windowBits value. - CVE-2017-3738: Embedded OpenSSL is vulnerable to...

SUSE-SU-2018:0002-1 Security update for nodejs4

This update for nodejs4 fixes the following issues: Security issues fixed: - CVE-2017-15896: Vulnerable to CVE-2017-3737 due to embedded OpenSSL bsc1072322. - CVE-2017-14919: Embedded zlib issue could cause a DoS via specific windowBits value. - CVE-2017-3738: Embedded OpenSSL is vulnerable to...

DNS Traffic Capture: DNSCAP

dnscap is a network capture utility designed specifically for DNS traffic. It produces binary data in pcap3 and other format. This utility is similar to tcpdump1, but has a number of features tailored to DNS transactions and protocol options. DNS-OARC uses dnscap for DITL data collections. Some o...

zlib: Out-of-bounds pointer arithmetic in inffast.c

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic...

zlib: Undefined left shift of negative number

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers...

zlib: Big-endian out-of-bounds pointer

The crc32big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation...

zlib: Out-of-bound pointer arithmetic in inftrees.c

A vulnerability was discovered in the inftrees.c file of zlib. Pointer arithmetic operations violate the C standard by subtracting an offset from an array pointer before its allocated memory, leading to undefined behavior...