The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of AIX

vulnerability alert CVE-2019-8936

NTP.org: NULL pointer dereference via Authenticated Mode 6

Synthesis of the vulnerability

An attacker can force a NULL pointer to be dereferenced via Authenticated Mode 6 of NTP.org, in order to trigger a denial of service.
Impacted products: Fedora, FreeBSD, AIX, Meinberg NTP Server, Data ONTAP 7-Mode, NTP.org, openSUSE Leap, Solaris, pfSense, RSA Authentication Manager, Slackware, SUSE Linux Enterprise Desktop, SLES.
Severity: 2/4.
Consequences: denial of service on service, denial of service on client.
Provenance: user account.
Creation date: 08/03/2019.
Identifiers: 3565, bulletinapr2019, CVE-2019-8936, DSA-2019-093, FEDORA-2019-694e3aa4e8, FEDORA-2019-f781d5c4c6, FreeBSD-SA-19:04.ntp, NTAP-20190503-0001, openSUSE-SU-2019:1143-1, openSUSE-SU-2019:1158-1, SSA:2019-067-01, SUSE-SU-2019:0775-1, SUSE-SU-2019:0777-1, SUSE-SU-2019:0789-1, SUSE-SU-2019:13991-1, SUSE-SU-2019:14004-1, VIGILANCE-VUL-28701.

Description of the vulnerability

An attacker can force a NULL pointer to be dereferenced via Authenticated Mode 6 of NTP.org, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability alert CVE-2018-12549

Eclipse OpenJ9: NULL pointer dereference via Receiver Object

Synthesis of the vulnerability

An attacker can force a NULL pointer to be dereferenced via Receiver Object of Eclipse OpenJ9, in order to trigger a denial of service.
Impacted products: AIX, IBM API Connect, IBM i, WebSphere MQ, RHEL.
Severity: 2/4.
Consequences: denial of service on service, denial of service on client.
Provenance: intranet client.
Creation date: 07/03/2019.
Identifiers: CVE-2018-12549, ibm10875554, ibm10878376, ibm10882598, ibm10884286, RHSA-2019:0469-01, RHSA-2019:0472-01, RHSA-2019:1238-01, VIGILANCE-VUL-28686.

Description of the vulnerability

An attacker can force a NULL pointer to be dereferenced via Receiver Object of Eclipse OpenJ9, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability alert CVE-2018-1890

IBM Java: privilege escalation via RPATH

Synthesis of the vulnerability

An attacker can bypass restrictions via RPATH of IBM Java, in order to escalate his privileges.
Impacted products: AIX, IBM API Connect, IBM i, Rational ClearCase, Security Directory Server, Tivoli System Automation, WebSphere AS Liberty, WebSphere AS Traditional, SUSE Linux Enterprise Desktop, SLES.
Severity: 2/4.
Consequences: administrator access/rights, privileged access/rights.
Provenance: user shell.
Creation date: 06/03/2019.
Identifiers: CVE-2018-1890, ibm10873042, ibm10875554, ibm10878234, ibm10878236, ibm10878376, ibm10882598, ibm10883400, ibm10885024, SUSE-SU-2019:0617-1, VIGILANCE-VUL-28666.

Description of the vulnerability

An attacker can bypass restrictions via RPATH of IBM Java, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2019-1559

OpenSSL 1.0.2: information disclosure via 0-byte Record Padding Oracle

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via 0-byte Record Padding Oracle of OpenSSL 1.0.2, in order to obtain sensitive information.
Impacted products: SDS, SES, SNS, Blue Coat CAS, Debian, AIX, IBM i, Rational ClearCase, Tivoli Storage Manager, Juniper EX-Series, Juniper J-Series, Junos OS, SRX-Series, MariaDB ~ precise, McAfee Web Gateway, MySQL Community, MySQL Enterprise, Nodejs Core, OpenSSL, openSUSE Leap, Oracle Fusion Middleware, Oracle Identity Management, Solaris, WebLogic, Percona Server, RHEL, SIMATIC, Slackware, SUSE Linux Enterprise Desktop, SLES, Symantec Content Analysis, Synology DSM, Synology DS***, Synology RS***, Nessus, Ubuntu, WinSCP.
Severity: 2/4.
Consequences: data reading.
Provenance: internet client.
Creation date: 26/02/2019.
Identifiers: bulletinapr2019, bulletinjul2019, CERTFR-2019-AVI-080, CERTFR-2019-AVI-132, CERTFR-2019-AVI-214, CERTFR-2019-AVI-325, cpuapr2019, cpujul2019, CVE-2019-1559, DLA-1701-1, DSA-4400-1, ibm10876638, ibm10886237, ibm10886659, JSA10949, openSUSE-SU-2019:1076-1, openSUSE-SU-2019:1105-1, openSUSE-SU-2019:1173-1, openSUSE-SU-2019:1175-1, openSUSE-SU-2019:1432-1, openSUSE-SU-2019:1637-1, RHBUG-1683804, RHBUG-1683807, RHSA-2019:2304-01, RHSA-2019:2471-01, SB10282, SSA:2019-057-01, SSB-439005, STORM-2019-001, SUSE-SU-2019:0572-1, SUSE-SU-2019:0600-1, SUSE-SU-2019:0658-1, SUSE-SU-2019:0803-1, SUSE-SU-2019:0818-1, SUSE-SU-2019:1362-1, SUSE-SU-2019:14091-1, SUSE-SU-2019:14092-1, SUSE-SU-2019:1553-1, SUSE-SU-2019:1608-1, SYMSA1490, TNS-2019-02, USN-3899-1, VIGILANCE-VUL-28600.

Description of the vulnerability

An attacker can bypass access restrictions to data via 0-byte Record Padding Oracle of OpenSSL 1.0.2, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2019-6110

OpenSSH scp, PuTTY PSCP: spoofing via Scp Client ANSI Codes stderr File Hidding

Synthesis of the vulnerability

An attacker can spoof displayed filenames on the scp client of OpenSSH and PuTTY, in order to deceive the victim.
Impacted products: AIX, IBM i, OpenSSH, openSUSE Leap, Solaris, PuTTY, SUSE Linux Enterprise Desktop, SLES, Synology DSM, Synology DS***, Synology RS***.
Severity: 1/4.
Consequences: disguisement.
Provenance: internet server.
Creation date: 14/01/2019.
Identifiers: bulletinjan2019, CVE-2019-6110, ibm10731015, openSUSE-SU-2019:0091-1, openSUSE-SU-2019:0093-1, SUSE-SU-2019:0125-1, SUSE-SU-2019:0126-1, SUSE-SU-2019:0132-1, SUSE-SU-2019:13931-1, VIGILANCE-VUL-28262.

Description of the vulnerability

An attacker can spoof displayed filenames on the scp client of OpenSSH and PuTTY, in order to deceive the victim.
Full Vigil@nce bulletin... (Free trial)

vulnerability alert CVE-2019-6109

OpenSSH scp, PuTTY PSCP: spoofing via Scp Client ANSI Codes File Hidding

Synthesis of the vulnerability

An attacker can spoof displayed filenames on the scp client of OpenSSH and PuTTY, in order to deceive the victim.
Impacted products: Debian, Fedora, AIX, IBM i, OpenSSH, openSUSE Leap, Solaris, PuTTY, RSA Authentication Manager, SUSE Linux Enterprise Desktop, SLES, Synology DSM, Synology DS***, Synology RS***, Ubuntu.
Severity: 1/4.
Consequences: disguisement.
Provenance: internet server.
Creation date: 14/01/2019.
Identifiers: bulletinjan2019, CVE-2019-6109, DLA-1728-1, DSA-2019-117, DSA-4387-1, DSA-4387-2, FEDORA-2019-0f4190cdb0, ibm10731015, openSUSE-SU-2019:0091-1, openSUSE-SU-2019:0093-1, openSUSE-SU-2019:0307-1, openSUSE-SU-2019:1602-1, SUSE-SU-2019:0125-1, SUSE-SU-2019:0126-1, SUSE-SU-2019:0132-1, SUSE-SU-2019:0496-1, SUSE-SU-2019:0941-1, SUSE-SU-2019:13931-1, SUSE-SU-2019:14016-1, SUSE-SU-2019:14030-1, SUSE-SU-2019:1524-1, USN-3885-1, USN-3885-2, VIGILANCE-VUL-28261.

Description of the vulnerability

An attacker can spoof displayed filenames on the scp client of OpenSSH and PuTTY, in order to deceive the victim.
Full Vigil@nce bulletin... (Free trial)

vulnerability note CVE-2018-1388

IBM GSKit: information disclosure via PKCS#1 Padding Side Channel

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via PKCS#1 Padding Side Channel of IBM GSKit, in order to obtain sensitive information.
Impacted products: AIX, WebSphere MQ.
Severity: 2/4.
Consequences: data reading.
Provenance: intranet client.
Creation date: 17/12/2018.
Identifiers: 2013022, CVE-2018-1388, VIGILANCE-VUL-28034.

Description of the vulnerability

An attacker can bypass access restrictions to data via PKCS#1 Padding Side Channel of IBM GSKit, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability note CVE-2018-19519 CVE-2019-1010220

tcpdump: out-of-bounds memory reading via print_prefix

Synthesis of the vulnerability

An attacker can force a read at an invalid address via print_prefix() of tcpdump, in order to trigger a denial of service, or to obtain sensitive information.
Impacted products: AIX, openSUSE Leap, Solaris, SUSE Linux Enterprise Desktop, SLES, tcpdump.
Severity: 2/4.
Consequences: data reading, denial of service on service, denial of service on client.
Provenance: internet client.
Number of vulnerabilities in this bulletin: 2.
Creation date: 17/12/2018.
Identifiers: 763, bulletinjul2019, CVE-2018-19519, CVE-2019-1010220, openSUSE-SU-2018:4144-1, openSUSE-SU-2018:4252-1, openSUSE-SU-2019:1964-1, SUSE-SU-2018:4131-1, SUSE-SU-2018:4149-1, SUSE-SU-2019:2087-1, SUSE-SU-2019:2088-1, VIGILANCE-VUL-28029.

Description of the vulnerability

An attacker can force a read at an invalid address via print_prefix() of tcpdump, in order to trigger a denial of service, or to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2017-3623

Solaris: privilege escalation via RPC Component

Synthesis of the vulnerability

An attacker can bypass restrictions via RPC Component of Solaris, in order to escalate his privileges.
Impacted products: AIX, Solaris.
Severity: 3/4.
Consequences: administrator access/rights, privileged access/rights.
Provenance: intranet client.
Creation date: 12/12/2018.
Identifiers: cpuapr2017, CVE-2017-3623, VIGILANCE-VUL-28010.

Description of the vulnerability

An attacker can bypass restrictions via RPC Component of Solaris, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2018-5407

OpenSSL: information disclosure via ECC Scalar Multiplication

Synthesis of the vulnerability

On an Intel processor (VIGILANCE-VUL-27667), an attacker can measure the execution time of the ECC Scalar Multiplication of OpenSSL, in order to obtain the used key.
Impacted products: Blue Coat CAS, Debian, BIG-IP Hardware, TMOS, AIX, IRAD, Rational ClearCase, QRadar SIEM, MariaDB ~ precise, MySQL Community, MySQL Enterprise, OpenBSD, OpenSSL, openSUSE Leap, Oracle Communications, Oracle Fusion Middleware, Oracle Identity Management, Solaris, Tuxedo, WebLogic, Percona Server, XtraBackup, RHEL, Slackware, SUSE Linux Enterprise Desktop, SLES, Symantec Content Analysis, Synology DSM, Synology DS***, Synology RS***, Nessus, Ubuntu, WinSCP.
Severity: 1/4.
Consequences: data reading.
Provenance: user shell.
Creation date: 12/11/2018.
Identifiers: bulletinjan2019, CERTFR-2018-AVI-607, CERTFR-2019-AVI-242, cpuapr2019, cpujan2019, cpujul2019, CVE-2018-5407, DLA-1586-1, DSA-4348-1, DSA-4355-1, ibm10794537, ibm10875298, ibm10886313, K49711130, openSUSE-SU-2018:3903-1, openSUSE-SU-2018:4050-1, openSUSE-SU-2018:4104-1, openSUSE-SU-2019:0088-1, openSUSE-SU-2019:0234-1, RHSA-2019:0483-01, RHSA-2019:2125-01, SSA:2018-325-01, SUSE-SU-2018:3864-1, SUSE-SU-2018:3864-2, SUSE-SU-2018:3866-1, SUSE-SU-2018:3964-1, SUSE-SU-2018:3989-1, SUSE-SU-2018:4001-1, SUSE-SU-2018:4068-1, SUSE-SU-2018:4274-1, SUSE-SU-2019:0117-1, SUSE-SU-2019:0395-1, SUSE-SU-2019:1553-1, SYMSA1490, TNS-2018-16, TNS-2018-17, USN-3840-1, VIGILANCE-VUL-27760.

Description of the vulnerability

On an Intel processor (VIGILANCE-VUL-27667), an attacker can measure the execution time of the ECC Scalar Multiplication of OpenSSL, in order to obtain the used key.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about AIX: