BSA-2019-755

Security Advisory ID : BSA-2019-755 Component : Apache Revision : 1.0: Final Apache 2.4 vulnerabilities in Brocade Fibre Channel Products from Broadcom Multiple Brocade Fibre Channel technology products from Broadcom incorporate Apache httpd 2.4 librairies. Apache released in January 2019, a list...

BSA-2018-744

Security Advisory ID : BSA-2018-744 Component : Webconsole Revision : 1.0: Initial A Vulnerability in Brocade Network Advisor Version before 14.1.0 could allow a remote unauthenticated attacker to execute arbitray code.The vulnerability could also be exploited to execute arbitrary OS Commands...

BSA-2018-708

Security Advisory ID : BSA-2018-708 Component : Ghostscript Revision : 1.0: Final Ghostscript contains an optional -dSAFER option, which is supposed to prevent unsafe PostScript operations. Multiple PostScript operations bypass the protections provided by -dSAFER, which can allow an attacker to...

BSA-2018-589

Security Advisory ID : BSA-2018-589 Component : Oracle WebLogic Revision : 1.0: Final Vulnerability in the Oracle WebLogicServer component of Oracle Fusion Middleware subcomponent: WLS Core Components. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily...

BSA-2018-553

Security Advisory ID : BSA-2018-553 Component : Apache HTTPD Revision : 2.0: Final When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.33 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the...

BSA-2018-556

Security Advisory ID : BSA-2018-556 Component : Apache HTTPD Revision : 2.0: Final The expression specified in could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are...

BSA-2018-557

Security Advisory ID : BSA-2018-557 Component : Apache HTTPD Revision : 2.0: Final In Apache httpd, modauthnzldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not...

BSA-2017-451

Security Advisory ID : BSA-2017-451 Component : dhcp6 Revision : 2.0: Final A stack buffer overflow was found in dnsmasq in the DHCPv6 code. An attacker on the local network could send a crafted DHCPv6 request to dnsmasq which would cause it to a crash or, potentially, execute arbitrary code...

BSA-2017-360

Security Advisory ID : BSA-2017-360 Component : Linux Kernel Revision : 2.0: Interim The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMITSTACK is set to RLIMITINFINITY and 1 Gigabyte of memory is allocated the maximum under the 1/4 restriction then the stack will b...

BSA-2017-410

Security Advisory ID : BSA-2017-410 Component : Java Revision : 2.0: Interim Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Libraries. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable...

BSA-2017-384

Security Advisory ID : BSA-2017-384 Component : HEIMDAL/ KERBEROS 5 Revision : 2.0: Interim OHeimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification. In...

BSA-2017-353

Security Advisory ID : BSA-2017-353 Component : Linux Kernel Revision : 3.0: Interim The IPv6 DCCP implementation in the Linux kernel mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue t...

BSA-2017-351

Security Advisory ID : BSA-2017-351 Component : Linux Kernel Revision : 3.0: Interim Theinetcskclonelockfunction in net/ipv4/inetconnectionsock.cin the Linux kernel allows attackers to cause a denial of service double free or possibly have unspecified other impact by leveraging use of the accept...

BSA-2017-416

Security Advisory ID : BSA-2017-416 Component : Java Revision : 2.0: Interim Vulnerability in the Java SE component of Oracle Java SE subcomponent: Deployment. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Easily exploitable vulnerability allows unauthenticated attacke...

BSA-2017-397

Security Advisory ID : BSA-2017-397 Component : Java Revision : 2.0: Interim Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit:...

BSA-2017-407

Security Advisory ID : BSA-2017-407 Component : Java Revision : 2.0: Interim Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: JAXP. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable...

BSA-2017-412

Security Advisory ID : BSA-2017-412 Component : Java Revision : 2.0: Interim Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit...

BSA-2017-348

Security Advisory ID : BSA-2017-348 Component : StrongSwan Revision : 2.0: Interim A denial-of-service vulnerability in the x509 plugin was discovered instrongSwan. All versions are affected. Incorrect Handling of CHOICE types in ASN.1 parser and x509 plugin ASN.1 CHOICE types are not correctly...

BSA-2017-341

Security Advisory ID : BSA-2017-341 Component : Samba Revision : 1.0: Interim All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute...

BSA-2017-342

Security Advisory ID : BSA-2017-342 Component : Freeradius Revision : 2.0: Interim The TLS session cache inFreeRADIUS2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remo...

BSA-2017-338

Security Advisory ID : BSA-2017-338 Component : N/A Revision : 1.0: Final A ransomware calledWannaCryinfected computers in several countries. Computers that became infected had not been patched. Microsoft released a security bulletin on March 14th, 2017, titled Microsoft Security Bulletin MS17-01...

BSA-2017-291

Security Advisory ID : BSA-2017-291 Component : NTP Revision : 1.0: Interim NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPIDLLS environment variable. Affected Products Brocade is investigating its product lines to...

BSA-2017-289

Security Advisory ID : BSA-2017-289 Component : NTP Revision : 1.0: Interim A vulnerability found in the NTP server allows an authenticated remote attacker to crash the daemon by sending an invalid setting viathe :configdirective. Theunpeeroption expects a number or an address as an argument. In...

BSA-2017-237

Security Advisory ID : BSA-2017-237 Component : Stack Buffer Overflow Issue in BSD libc Revision : 1.0: Interim The BSDlibclibrary'slinkntoa function may be vulnerable to a classic buffer overflow. It is currently unclear if this issue is exploitable. Affected Products Brocade is investigating it...

BSA-2017-212

Security Advisory ID : BSA-2017-212 Component : libidn Revision : 2.0: Final The stringpreputf8nfkcnormalize function in lib/nfkc.cinlibidnbefore 1.33 allows context-dependent attackers to cause a denial of service out-of-bounds read and crash via crafted UTF-8 data...

BSA-2017-210

Security Advisory ID : BSA-2017-210 Component : libidn Revision : 2.0: Final idnin GNUlibidnbefore 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read...

BSA-2016-182

Security Advisory ID : BSA-2016-182 Component : OpenSSH Revision : 3.0: Final The x11openhelper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypa...

BSA-2016-007

Summary Security Advisory ID : BSA-2016-007 Component : Kernel Revision : 2.0 N/A...

BSA-2014-001

Summary Security Advisory ID : BSA-2014-001 Component : N/A Revision : 2.0 N/A...

BSA-2015-002

Summary Security Advisory ID : BSA-2015-002 Component : NTP Revision : 7.0 N/A...

Rocky Linux Security Update for kernel, libssg, gnupg2, python3.9 & tar

Brocade SANnav OVA has provided Security updates for the following vulnerabilities. Rocky Linux 9 : Security Update for python3.9 RLSA-2026:1478 cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service CVE-2025-12084 Rocky Linux Security Update for kernel RLSA-2025:22865 kernel:...

SQL injection vulnerability on multiple external APIs

In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters...

Spring Framework STOMP CSRF Vulnerability (CVE-2025-41254)

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework:6.2.0 - 6.2.11, 6.1.0 - 6.1.23, 6.0.x - 6.0.29, 5.3.0 - 5.3.45, Older, unsupported versions are also affected...

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing proto as an own property. An attacker can trigger this by providing a malicious...

Stack buffer overflow in CMS AuthEnvelopedData parsing in DR

Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS...

Switch discovery credentials can be seen in plain text inside sannavswapfie

A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the server hosting the Brocade SANnav Virtual Machine VM. This can happen when the SANnav server encounters an Out Of Memory OOM condition. The...

Multiple CURL vulnerabilities in Brocade SANnav OVA deployments before SANnav 2.3.1b

Multiple CURL vulnerabilities Curl 7.44.0 8.7.0 vulnerabilities CVE-2024-2398, CVE-2024-2466, CVE-2024-2004 & CVE-2024-0853 Curl 7.44.0 8.7.0 HTTP/2 Push Headers Memory-leak CVE-2024-2398 Curl 7.85.0 8.7.0 Input Misinterpretation CVE-2024-2004 Curl 7.85.0 8.7.0 Input Misinterpretation CVE-2024-20...

PostgreSQL Vulnerable to Privilege Escalation via Improper Checks in 'pg_stats_ext' and 'pg_stats_ext_exprs' Functions

PostgreSQL is vulnerable to privilege escalation. An attacker could exploit this to access views without correct privileges, potentially gaining access to sensitive data that they shouldn't have access to...

PostgreSQL Vulnerable to Denial-of-Service (DoS) in 'pg_signal_backend()'

PostgreSQL contains a denial-of-service DoS vulnerability. An attacker with superuser permissions could exploit this issue to cause the database to crash...

flaw in the RPM package in the read functionality

A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity...

RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service

RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via an invalid region tag in a package header to the 1 headerLoad, 2 rpmReadSignature, or 3 headerVerify function...

CVE-2023-36664 - Artifex Ghostscript through 10.01.2 mishandles permission validation

Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices with the %pipe% prefix or the | pipe character prefix...

CVE-2022-2601 & CVE-2022-3775: Multiple GRUB2 vulnerabilities

Security Advisory ID : BSA-2022-2139 Component : GRUB2 Revision : 1.0 Brocade PSIRT has become aware of two grub vulnerabilities. CVE-2022-2601 grub2: A buffer overflow in grubfontconstructglyph can lead to out-of-bound write and possible secure boot by-pass A buffer overflow was found in...

CVE-2021-3712: ASN1_STRING structure contains a buffer holding the string data

Security Advisory ID : BSA-2022-1587 Component : OpenSSL Revision : 1.0 ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesent...

CVE-2021-34798. NULL pointer dereference in httpd core.

Security Advisory ID : BSA-2022-1597 Component : Apache httpd Revision : 1.0 Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier. Affected Products All versions of Brocade Fabric OS...

CVE-2022-0155: Exposure of Private Personal Information to an Unauthorized Actor

Security Advisory ID : BSA-2022-1676 Component : Follow-Redirects Revision : 2.0 follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor. Notes: Brocade Fabric OS does not use cookies; however, Brocade Fabric OS versions after v9.0.0 and before v9.1.1 d...

BSA-2022-1835

Security Advisory ID : BSA-2022-1835 Component : Oracle Java Revision : 1.0 Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition:...

License forgery in Brocade Fabric OS (FOS) hardware platforms running any version of Brocade Fabric OS software, (CVE-2021-27795)

Security Advisory ID : BSA-2022-1758 Component : Brocade Fabric OS License Revision : 2.0 Brocade Fabric OS FOS hardware platforms running any version of Brocade Fabric OS software, which supports the license string format; contain cryptographic issues that could allow for the installation of...

BSA-2020-972

Security Advisory ID : BSA-2020-972 Component : jQuery Revision : 1.0 In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untruste...

BSA-2019-888

Security Advisory ID : BSA-2019-888 Component : Eclipse OpenJ9 Revision : 1.0: Final From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks...