Medium WID-SEC-2023-2595 3 CVEs

IBM Security Guardium: Mehrere Schwachstellen

Published Oct 9, 2023 · Updated Oct 9, 2023 · de-DE

Vendor: IBM Product: Security Guardium Product: Security Guardium 11.3 Product: Security Guardium 11.4 Product: Security Guardium 11.5 Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Security Guardium ausnutzen, um beliebigen Programmcode auszuführen und einen Denial of Service Zustand zu verursachen.

Product

IBM Security Guardium ist eine Lösung für die Überwachung und Auditierung des Datenzugriffs.

Vulnerabilities 3

High 7.5

CVE-2019-14262

Uncontrolled Resource Consumption in MetadataExtractor

MetadataExtractor 2.1.0 allows stack consumption.

MetadataExtractor NuGet

Jul 25, 2019
Medium 5.5

CVE-2022-24613

Improper Handling of Exceptional Conditions inn metadata-extractor

metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash. This could be used to mount a denial of service attack against services that use metadata-extractor …

com.drewnoakes:metadata-extractor libmetadata-extractor-java libmetadata-extractor-java Debian Ubuntu Maven

Feb 24, 2022
Medium 5.5

CVE-2022-24614

Allocation of Resources Without Limits or Throttling in metadata-extractor

When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against…

libmetadata-extractor-java com.drewnoakes:metadata-extractor libmetadata-extractor-java Debian Ubuntu Maven

Feb 24, 2022

Revision history

2023-10-09 #1
Initiale Fassung

References

IBM Security Bulletin 7048802 vom 2023-10-09
https://www.ibm.com/support/pages/node/7048802