The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of IBM i

computer vulnerability alert CVE-2018-12549

Eclipse OpenJ9: NULL pointer dereference via Receiver Object

Synthesis of the vulnerability

An attacker can force a NULL pointer to be dereferenced via Receiver Object of Eclipse OpenJ9, in order to trigger a denial of service.
Impacted products: AIX, IBM i, WebSphere MQ, RHEL.
Severity: 2/4.
Consequences: denial of service on service, denial of service on client.
Provenance: intranet client.
Creation date: 07/03/2019.
Identifiers: CVE-2018-12549, ibm10875554, ibm10878376, ibm10884286, RHSA-2019:0469-01, RHSA-2019:0472-01, RHSA-2019:1238-01, VIGILANCE-VUL-28686.

Description of the vulnerability

An attacker can force a NULL pointer to be dereferenced via Receiver Object of Eclipse OpenJ9, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability alert CVE-2018-1890

IBM Java: privilege escalation via RPATH

Synthesis of the vulnerability

An attacker can bypass restrictions via RPATH of IBM Java, in order to escalate his privileges.
Impacted products: AIX, IBM i, Security Directory Server, Tivoli System Automation, WebSphere AS Liberty, WebSphere AS Traditional, SUSE Linux Enterprise Desktop, SLES.
Severity: 2/4.
Consequences: administrator access/rights, privileged access/rights.
Provenance: user shell.
Creation date: 06/03/2019.
Identifiers: CVE-2018-1890, ibm10873042, ibm10875554, ibm10878234, ibm10878236, ibm10878376, ibm10883400, SUSE-SU-2019:0617-1, VIGILANCE-VUL-28666.

Description of the vulnerability

An attacker can bypass restrictions via RPATH of IBM Java, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

vulnerability bulletin CVE-2019-5739

Node Core: denial of service via Keep-alive HTTP

Synthesis of the vulnerability

An attacker can trigger a fatal error via Keep-alive HTTP of Node Core, in order to trigger a denial of service.
Impacted products: IBM i, Nodejs Core, openSUSE Leap, SUSE Linux Enterprise Desktop, SLES.
Severity: 2/4.
Consequences: denial of service on service, denial of service on client.
Provenance: internet client.
Creation date: 01/03/2019.
Identifiers: CVE-2019-5739, ibm10787619, openSUSE-SU-2019:1076-1, openSUSE-SU-2019:1173-1, SUSE-SU-2019:0658-1, SUSE-SU-2019:0818-1, VIGILANCE-VUL-28633.

Description of the vulnerability

An attacker can trigger a fatal error via Keep-alive HTTP of Node Core, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2019-5737

Node Core: denial of service via Slowloris HTTP Keep-alive

Synthesis of the vulnerability

An attacker can trigger a fatal error via Slowloris HTTP Keep-alive of Node Core, in order to trigger a denial of service.
Impacted products: IBM i, Nodejs Core, openSUSE Leap, SUSE Linux Enterprise Desktop, SLES.
Severity: 2/4.
Consequences: denial of service on service, denial of service on client.
Provenance: internet client.
Creation date: 01/03/2019.
Identifiers: CVE-2019-5737, ibm10787619, openSUSE-SU-2019:1076-1, openSUSE-SU-2019:1173-1, openSUSE-SU-2019:1211-1, SUSE-SU-2019:0627-1, SUSE-SU-2019:0635-1, SUSE-SU-2019:0636-1, SUSE-SU-2019:0658-1, SUSE-SU-2019:0818-1, VIGILANCE-VUL-28632.

Description of the vulnerability

An attacker can trigger a fatal error via Slowloris HTTP Keep-alive of Node Core, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2019-1559

OpenSSL 1.0.2: information disclosure via 0-byte Record Padding Oracle

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via 0-byte Record Padding Oracle of OpenSSL 1.0.2, in order to obtain sensitive information.
Impacted products: SDS, SES, SNS, Debian, AIX, IBM i, MariaDB ~ precise, McAfee Web Gateway, MySQL Community, MySQL Enterprise, Nodejs Core, OpenSSL, openSUSE Leap, Solaris, Percona Server, SIMATIC, Slackware, SUSE Linux Enterprise Desktop, SLES, Synology DSM, Synology DS***, Synology RS***, Nessus, Ubuntu, WinSCP.
Severity: 2/4.
Consequences: data reading.
Provenance: internet client.
Creation date: 26/02/2019.
Identifiers: bulletinapr2019, CERTFR-2019-AVI-080, CERTFR-2019-AVI-132, CERTFR-2019-AVI-214, cpuapr2019, CVE-2019-1559, DLA-1701-1, DSA-4400-1, ibm10876638, openSUSE-SU-2019:1076-1, openSUSE-SU-2019:1105-1, openSUSE-SU-2019:1173-1, openSUSE-SU-2019:1175-1, SB10282, SSA:2019-057-01, SSB-439005, STORM-2019-001, SUSE-SU-2019:0572-1, SUSE-SU-2019:0600-1, SUSE-SU-2019:0658-1, SUSE-SU-2019:0803-1, SUSE-SU-2019:0818-1, TNS-2019-02, USN-3899-1, VIGILANCE-VUL-28600.

Description of the vulnerability

An attacker can bypass access restrictions to data via 0-byte Record Padding Oracle of OpenSSL 1.0.2, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

vulnerability note CVE-2019-6465

ISC BIND: information disclosure via DLZ Zone Transfer

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via DLZ Zone Transfer of ISC BIND, in order to obtain sensitive information.
Impacted products: Debian, BIG-IP Hardware, TMOS, IBM i, BIND, Solaris, Synology DSM, Ubuntu.
Severity: 2/4.
Consequences: data reading.
Provenance: internet client.
Creation date: 22/02/2019.
Identifiers: bulletinapr2019, CVE-2019-6465, DLA-1697-1, DSA-4440-1, ibm10876698, K00040234, K01713115, K25244852, Synology-SA-19:10, USN-3893-1, USN-3893-2, VIGILANCE-VUL-28584.

Description of the vulnerability

An attacker can bypass access restrictions to data via DLZ Zone Transfer of ISC BIND, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

vulnerability bulletin CVE-2018-5745

ISC BIND: assertion error via Managed-keys Trust Anchor Rolls Over

Synthesis of the vulnerability

An attacker can force an assertion error via Managed-keys Trust Anchor Rolls Over of ISC BIND, in order to trigger a denial of service.
Impacted products: Debian, BIG-IP Hardware, TMOS, IBM i, BIND, Solaris, Synology DSM, Ubuntu.
Severity: 2/4.
Consequences: denial of service on service.
Provenance: internet server.
Creation date: 22/02/2019.
Identifiers: bulletinapr2019, CVE-2018-5745, DLA-1697-1, DSA-4440-1, ibm10876698, K00040234, K01713115, K25244852, Synology-SA-19:10, USN-3893-1, USN-3893-2, VIGILANCE-VUL-28583.

Description of the vulnerability

An attacker can force an assertion error via Managed-keys Trust Anchor Rolls Over of ISC BIND, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2019-4040

IBM i: Cross Site Scripting via IBM Navigator

Synthesis of the vulnerability

An attacker can trigger a Cross Site Scripting via IBM Navigator of IBM i, in order to run JavaScript code in the context of the web site.
Impacted products: IBM i.
Severity: 2/4.
Consequences: client access/rights.
Provenance: document.
Creation date: 01/02/2019.
Identifiers: CVE-2019-4040, ibm10869384, VIGILANCE-VUL-28422.

Description of the vulnerability

The IBM i product offers a web service.

However, it does not filter received data via IBM Navigator before inserting them in generated HTML documents.

An attacker can therefore trigger a Cross Site Scripting via IBM Navigator of IBM i, in order to run JavaScript code in the context of the web site.
Full Vigil@nce bulletin... (Free trial)

vulnerability CVE-2018-17199

Apache httpd: privilege escalation via mod_session_cookie Ignored Expiry Time

Synthesis of the vulnerability

An attacker can bypass restrictions via mod_session_cookie Ignored Expiry Time of Apache httpd, in order to escalate his privileges.
Impacted products: Apache httpd, Debian, IBM i, Rational ClearCase, openSUSE Leap, Solaris, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 2/4.
Consequences: user access/rights.
Provenance: user account.
Creation date: 23/01/2019.
Identifiers: bulletinapr2019, CERTFR-2019-AVI-031, CVE-2018-17199, DLA-1647-1, DSA-4422-1, ibm10869064, ibm10872490, ibm10876972, openSUSE-SU-2019:0296-1, openSUSE-SU-2019:0305-1, SSA:2019-022-01, SUSE-SU-2019:0498-1, SUSE-SU-2019:0504-1, USN-3937-1, VIGILANCE-VUL-28330.

Description of the vulnerability

An attacker can bypass restrictions via mod_session_cookie Ignored Expiry Time of Apache httpd, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability note CVE-2018-17189

Apache httpd: denial of service via mod_http2

Synthesis of the vulnerability

An attacker can trigger a fatal error via mod_http2 of Apache httpd, in order to trigger a denial of service.
Impacted products: Apache httpd, Debian, IBM i, openSUSE Leap, Solaris, Slackware, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 2/4.
Consequences: denial of service on service.
Provenance: internet client.
Creation date: 23/01/2019.
Identifiers: bulletinapr2019, CERTFR-2019-AVI-031, CVE-2018-17189, DSA-4422-1, ibm10872490, openSUSE-SU-2019:0296-1, openSUSE-SU-2019:0305-1, SSA:2019-022-01, SUSE-SU-2019:0498-1, SUSE-SU-2019:0504-1, USN-3937-1, VIGILANCE-VUL-28329.

Description of the vulnerability

An attacker can trigger a fatal error via mod_http2 of Apache httpd, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about IBM i: