Kernel OVA security updates in ASCG 3.3.0a

CVE-2025-21756 vsock: Keep the binding until socket destruction CVE-2022-49011 hwmon: coretemp fix pci device refcount leak in nv1aramnew CVE-2024-53141 netfilter: ipset: add missing range check in bitmapipuadt CVE-2025-32462 Sudo before 1.9.17p1, when used with a sudoers file that specifies a ho...

Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

Libexpat contains a denial-of-service DoS vulnerability. A remote attacker could exploit this by chaining together an excessive number of general entities. Malicious use of this linear entity chain would subsequently result in uncontrolled recursion, leading to a stack overflow and crash...

Rocky Linux Updates in ASCG 3.3.0a (OVA)

Multiple Rocky Linux updates applied to Brocade ASCG 3.3.0a RockyLinux 8:perl RLSA-2025:11805 perl: Perl threads have a working directory race condition where file operations may target unintended paths CVE-2025-40909 RockyLinux 8:libxslt RLSA-2025:3615 libxslt: Use-After-Free in libxslt numbers....

Difficult to exploit Java SDK Updates in ASCG

Difficult to exploit vulnerabilities in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9,...

Netty Vulnerable to Denial-of-Service (DoS) via Uncontrolled Memory Allocation in 'HttpPostRequestDecoder' Component

Netty is vulnerable to denial-of-service DoS due to insufficient restrictions on the amount of memory that is allocated in the HttpPostRequestDecoder component. An attacker could exploit this by sending maliciously crafted data in order to cause an out-of-memory OOM error and a denial-of-service...

Azul Zulu Java Multiple Vulnerabilities (January 2025)

Azul Zulu Multiple Vulnerabilities January 2025 CVE-2025-0509 CVSS 3.1 Base Score 7.3 CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H Brocade SANnav not affected: VEX Justification: Vulnerablecodenotpresent CVE-2025-21502 CVSS 3.1 Base Score 4.8 CVSS Vector:...

Heap buffer overflow in libwebp (CVE-2023-4863)

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Products Confirmed Not Affected No Brocade Fibre Channel products from Broadcom are known to be affected by this...

BSA-2021-1722

Security Advisory ID : BSA-2021-1722 Component : hard-coded credentials Revision : 1.0 Brocade Fabric OS before Brocade Fabric OS v8.2.1c, v8.1.2h, and all versions of Brocade Fabric OS v8.0.x and v7.x contain documented hard-coded credentials, which could allow attackers to gain access to the...

BSA-2021-1652

Security Advisory ID : BSA-2021-1652 Component : JMSAppender in Log4j 1.2 Revision : 1.0 CVE-2021-4104 - JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and...

BSA-2016-010

Summary Security Advisory ID : BSA-2016-010 Component : Linux Kernel Revision : 5.0 N/A...

Rocky Linux Security Update for glibc (RLSA-2026:2786) and kernel (RLSA-2026:2722)

Brocade SANnav OVA has provided security updates for Multiple vulnerabilities ias referenced in glibc RLSA-2026:2786, kernel RLSA-2026:2722 glibc RLSA-2026:2786 glibc: Integer overflow in memalign leads to heap corruption CVE-2026-0861 glibc: glibc: Information disclosure via zero-valued network...

Multiple Vulnerabilities in Node.js (Wednesday, May 14, 2025 Security Releases). Nessus Plugin ID 236766

In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uvfss.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory...

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an...

jwt-go allows excessive memory allocation during header parsing

golang-jwt is vulnerable to excessive memory allocation due to improper handling of the parse.ParseUnverified function. This could allow an attacker to cause significant memory consumption by sending a malicious request with an Authorization header containing many period characters...

Multiple vulnerabilities detected in PostgreSQL

Multiple PostgreSQL vulnerability updates CVE-2025-1094-PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation CVE-2024-10979-PostgreSQL PL/Perl environment variable changes execute arbitrary code CVE-2024-10978-PostgreSQL SET ROLE, SET SESSION AUTHORIZATI...

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue...

snappy-java Vulnerable to Denial-of-Service (DoS) due to Improper Input Validation in File 'SnappyInputStream.java'

In snappy-java the stream chunk processing implementation uses a user controlled value to define the size of an allocated array. A remote attacker may abuse this by creating a crafted input stream that causes an extremely large array to be allocated, or a negative array size to be used. Both case...

A flaw was discovered in the XFS source in the Linux kernel (CVE-2020-12655)

An issue was discovered in xfsagfverify in fs/xfs/libxfs/xfsalloc.c in the Linux kernel through 5.6.10. Attackers may trigger a sync of excessive duration via an XFS v5 image with crafted metadata, aka CID-d0c7feaf8767...

BSA-2022-1768

Security Advisory ID : BSA-2022-1768 Component : Spring Cloud Revision : 1.0 In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in...

AMNESIA:33. (BSA-2020-1167)

Security Advisory ID: BSA-2020-1167 Component: Open source TCP/IP stacks. Revision: 1.1 Forescout Research Labs discovered 33 vulnerabilities impacting millions of IoT, OT, and IT devices that present an immediate risk for organizations worldwide.These vulnerabilities are named AMNESIA:33. Detail...

BSA-2020-1046

Security Advisory ID : BSA-2020-1046 Component : Apache Tomcat Revision : 1.0: Final When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory e.g. redirecting to '/foo/' when the user requested '/foo' a speciall...

BSA-2018-604

Security Advisory ID : BSA-2018-604 Component : System Revision : 1.0: Final Multiple GPON Home Routers could allow a remote attacker to execute arbitrary commands on the system, caused by the ping and trace route commands running at root level on the diagnostic page. An attacker could exploit th...

BSA-2017-356

Security Advisory ID : BSA-2017-356 Component : Heap Stack Revision : 2.0: Interim A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap or different memory region and stack memory regions were adjacent to each other, an attacker could use this flaw ...

BSA-2017-321

Security Advisory ID : BSA-2017-321 Component : JAVA SE Revision : 3.0: Final Vulnerability in the Java SE component of Oracle Java SE subcomponent: AWT. Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121. Difficult to exploit vulnerability allows unauthenticated attacker wi...

BSA-2017-336

Security Advisory ID : BSA-2017-336 Component : zlib Revision : 2.0: Interim There was a small optimization for PowerPCs to pre-increment a pointer when accessing a word, instead of post-incrementing. This required prefacing the loop with a decrement of the pointer, possibly pointing before the...

BSA-2017-349

Security Advisory ID : BSA-2017-349 Component : SUDO Revision : 2.0: Interim A flaw was found in the waysudoparsedttyinformation from the process status file in the proc filesystem. A local user with privileges to execute commands viasudocould use this flaw to escalate their privileges to root...

BSA-2017-242

Security Advisory ID : BSA-2017-242 Component : Linksys Revision : 1.0: Interim LinksysEtherFastBEFN2PS4, BEFSR41, and BEFSR81 Routers, and possibly other products, allow remote attackers to gain sensitive information and cause a denial of service via an SNMP query for the default community strin...

xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284)

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSGSPLICEPAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFLSHAREDFRAG after skbsplicefromiter, so later paths that may modify packet data ca...

A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing

GNU TLS is vulnerable to a denial-of-service DoS due to inefficient certificate processing in the libtasn1 library. An attacker could present a maliciously crafted certificate that contains a large amount of subject alternative name or name constraint inputs, potentially leading to excessive...

Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100

Brocade ASCG before 3.2.0 WebGui is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and...

command injection in scp.c

The scp functionality in OpenSSH is vulnerable to command injection via backtick characters in the destination argument. The command will be run with the permissions of the user with which the files were copied on the remote server. To exploit this issue an attacker must manipulate a system...

CVE-2022-47941, CVE-2022-47942, CVE-2022-47938, CVE-2022-47939, CVE-2022-47940. Vulnerabilities affecting the ksmb module in the Linux kernel versions 5.14 through 5.15.61. (BSA-2022-2157).

Security Advisory ID: BSA-2022-2157 Component: ksmbd module in the Linux kernel Revision: 2.1 Brocade PSIRT has become aware of several vulnerabilities affecting theksmbdmodule in the Linux kernel published by Trend Micro Zero Day Initiative. ZDI-22-1687 - CVSS SCORE: 5.3 - CVE-2022-47941...

BSA-2022-1747

Security Advisory ID : BSA-2022-1747 Component : Kernel Revision : 1.0 A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copypagetoiterpipe and pushpipe functions in the Linux kernel and could thus contain stale values. An...

Brocade Fabric OS Web application service fails to properly process malformed authentication headers resulting in reading memory addresses outside the intended range. (CVE-2021-27791)

Security Advisory ID : BSA-2021-1491 Component : Web Application Service Revision : 1.1 The function that is used to parse the Authentication header in Brocade Fabric OS Web application service before Brocade Fabric OS v9.0.1a and v8.2.3a fails to properly process a malformed authentication heade...

BSA-2020-1166

Security Advisory ID : BSA-2020-1166 Component : OpenSSL Revision : 1.0 The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERALNAMEcmp which compares different instances of a...

BSA-2019-785

Security Advisory ID : BSA-2019-785 Component : BMC/IPMI Revision : 1.0: Initial The ASPEED ast2400 and ast2500 Baseband Management Controller BMC hardware and firmware implement Advanced High-performance Bus AHB bridges, which allow arbitrary read and write access to the BMC's physical address...

BSA-2018-730

Security Advisory ID : BSA-2018-730 Component : Fabric OS CLI Revision : 1.0: Initial Multiple Vulnerabilities in Brocade Fabric OS command line interface CLIcould allow a local attacker toescape the restricted shell and, gain root access. Commands Affected firmwaredownload command -CVE-2018-6436...

BSA-2018-729

Security Advisory ID : BSA-2018-729 Component : Fabric OS CLI Revision : 1.0: Initial A vulnerability in the secryptocfg command of Brocade Fabric OS command line interface CLIcould allow a local attacker toescape the restricted shell and, gain root access. Affected Products Brocade Fabric OS...

BSA-2017-328

Security Advisory ID : BSA-2017-328 Component : JAVA SE Networking Revision : 3.0: Final Vulnerability in the Java SE, Java SE Embedded,JRockitcomponent of Oracle Java SE subcomponent: Networking. Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded:...

BSA-2017-322

Security Advisory ID : BSA-2017-322 Component : JAVA SE AWT Revision : 3.0: Final Vulnerability in the Java SE component of Oracle Java SE subcomponent: AWT. Supported versions that are affected are Java SE: 7u131 and 8u121. Difficult to exploit vulnerability allows unauthenticated attacker with...

BSA-2017-259

Security Advisory ID : BSA-2017-259 Component : Weak ciphers such as RC4-MD5 Revision : 1.0: Interim If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually...

BSA-2017-206

Security Advisory ID : BSA-2017-206 Component : OpenSSL Revision : 1.0: Interim Severity: Moderate-Applications parsing invalid CMS structures can crash with a NULL pointerdereference. This is caused by a bug in the handling of the ASN.1 CHOICE typein OpenSSL 1.1.0 which can result in a NULL valu...

BSA-2015-1935

Security Advisory ID : BSA-2015-1935 Component : TLS protocol 1.2 Revision : 5.0 The TLS protocol 1.2 and earlier, when a DHEEXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHEEXPORT choice, which allows man-in-the-middle attackers to conduct...

BSA-2015-004

Summary Security Advisory ID : BSA-2015-004 Component : OpenSSL Revision : 6.0 N/A...

Rocky Linux security update in Brocade ASCG 3.4.0c (CVE-2025-68724, CVE-2026-23401, CVE-2026-31402, CVE-2025-40252)

CVE-2025-68724- Title: crypto: asymmetrickeys - prevent overflow in asymmetrickeygenerateid Description In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - prevent overflow in asymmetrickeygenerateid Use checkaddoverflow to guard against potential integer...

PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation

Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions before PostgreSQL 17.5, 16.9, 15.13,...

An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0

An allocation of resources without limits or throttling vulnerability exists in curl v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this...

Brocade SANnav encryption key is logged in the debug logs (CVE-2025-1053)

Under certain error conditions at time of Brocade SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave. An attacker with privileged access to the Brocade SANnav database could use the encryption key to obtain passwords used by Broca...

Security Advisory Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), Ivanti Secure Access Client (ISAC) (Multiple CVEs)

Brocade Security Team has become aware of CVEs for Ivanti Connect Secure ICS,Ivanti Policy Secure IPS and Ivanti Secure Access Client ISAC. Vulnerability Details CVE Number| Description| CVSS Score Severity| CVSS Vector| CWE| Impacted Products ---|---|---|---|---|--- CVE-2024-47905| A stack-based...

Multiple CVEs identified by vulnerability scanning tools addressed via Brocade ASCG v3.1.0

ASCG v3.1.0 utilizes Rocky Linux version 8.10, addressing a number of potential security vulnerabilities. A complete list of CVEs reported by Rocky Linux as being addressed in this update are provided in the ASCG v3.1.0 Release Notes. In addition, a number of CVEs identified via internal security...