High WID-SEC-2023-1790 7 CVEs

IBM Security Guardium: Mehrere Schwachstellen

Published Jul 18, 2023 · Updated Jul 18, 2023 · de-DE

Vendor: IBM Product: Security Guardium 11.3 Platform: Linux

Summary

Ein Angreifer aus dem angrenzenden Netzwerk, ein entfernter, anonymer oder ein lokaler Angreifer kann mehrere Schwachstellen in IBM Security Guardium ausnutzen, um seine Privilegien zu erhöhen, beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.

Product

IBM Security Guardium ist eine Lösung für die Überwachung und Auditierung des Datenzugriffs.

Vulnerabilities 7

Critical 9.8

CVE-2022-37434 Public exploit EPSS 19%

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip heade…

openjpeg2 rsync fltk gdal Debian Ubuntu Azure Linux Alpine Wolfi

Aug 5, 2022
High 8.8

CVE-2022-1271

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's ch…

gzip xz-utils xz xz-utils Debian Ubuntu Azure Linux Alpine

Aug 31, 2022
High 8.1

CVE-2022-24903 Public exploit

Buffer overflow in TCP syslog server (receiver) components in rsyslog

Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability…

rsyslog rsyslog rsyslog rsyslog Debian Ubuntu Azure Linux Alpine

May 5, 2022
High 7.8

CVE-2022-4378

A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jan 5, 2023
High 7.4

CVE-2023-0286 Public exploit EPSS 68%

X.400 address type confusion in X.509 GeneralName

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address fiel…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi PyPI crates.io

Feb 8, 2023
Medium 4.3

CVE-2022-43908

IBM Security Guardium denial of service

IBM Security Guardium 11.3 could allow an authenticated user to cause a denial of service due to improper input validation. IBM X-Force ID: 240903.

IBM Security Guardium

Jul 19, 2023
Unscored —

CVE-2020-12321

Improper buffer restriction in some Intel(R) Wireless Bluetooth(R) products before version 21.110 may allow an unauthen…

Nov 12, 2020

Revision history

2023-07-18 #1
Initiale Fassung

References

IBM Security Bulletin: 7007815 vom 2023-07-18
https://www.ibm.com/support/pages/node/7007815