Skip to content
OpenAdvisories
Medium WID-SEC-2023-2774 4 CVEs

IBM Maximo Asset Management: Mehrere Schwachstellen ermöglichen Denial of Service

Published Oct 29, 2023 · Updated Oct 29, 2023 · de-DE

Vendor: IBM Product: Maximo Asset Management Product: Maximo Asset Management 7.6.1.2 Product: Maximo Asset Management 7.6.1.3 Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM Maximo Asset Management ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Maximo Asset Management ist ein Enterprise-Asset-Management-System, das umfassenden Support für Assets, Maintenance, Ressourcen und Supply-Chain-Management-Anforderungen bietet.

Vulnerabilities 4

  • High 7.5
    CVE-2023-34455

    snappy-java's unchecked chunk length leads to DoS

    snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in versions prior to 1.1.10.1. The code in the function hasNextChunk in the fileSnappyInputStream.java checks if a given st…

    xerial snappy-java druid snappy-java Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2023-34462

    netty-handler SniHandler 16MB allocation

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler…

    netty netty netty netty Debian Ubuntu Wolfi Maven
  • Medium 5.9
    CVE-2023-34453

    snappy-java's Integer Overflow vulnerability in shuffle leads to DoS

    snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing a fatal error. The function `shuffle(int[] input)` in the file `BitShuffle.java` receives an array o…

    xerial snappy-java druid snappy-java Ubuntu Wolfi Maven
  • Medium 5.9
    CVE-2023-34454

    snappy-java's Integer Overflow vulnerability in compress leads to DoS

    snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing an unrecoverable fatal error. The function `compress(char[] input)` in the file `Snappy.java` receiv…

    xerial snappy-java druid snappy-java Ubuntu Wolfi Maven

Revision history

  1. #1

    Initiale Fassung

References