The OVAL Repository 5.4 2015-09-03T06:35:21.076-04:00 IBM AIX 6.1 Buffer overflow in qosmod in bos.net.tcp.server in IBM AIX 6.1 and VIOS 2.1 allows local users to gain privileges via unspecified vectors. J. Daniel Brown DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.2 IBM AIX 5.3 IBM AIX 6.1 Stack-based buffer overflow in muxatmd in IBM AIX 5.2, 5.3, and 6.1 allows local users to gain privileges via a long filename. Aharon Chernin DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 nfs.ext in IBM AIX 5.3.x through 5.3.9 and 6.1.0 through 6.1.2 does not properly use the nfs_portmon setting, which allows remote attackers to bypass intended access restrictions for NFSv4 shares via unspecified vectors. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 gssd in IBM AIX 5.3.x through 5.3.9 and 6.1.0 through 6.1.2 does not properly handle the NFSv4 Kerberos credential cache, which allows local users to bypass intended access restrictions for Kerberized NFSv4 shares via unspecified vectors. Pai Peng DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 Buffer overflow in autoconf6 in IBM AIX 6.1.0 through 6.1.2, when Role-Based Access Control is enabled, allows local users with aix.network.config.tcpip authorization to gain privileges via unspecified vectors. Aharon Chernin DRAFT INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 The malloc subsystem in libc in IBM AIX 5.3 and 6.1 allows local users to create or overwrite arbitrary files via a symlink attack on the log file associated with the MALLOCDEBUG environment variable. Aharon Chernin DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 The WPAR system call implementation in the kernel in IBM AIX 6.1 allows local users to cause a denial of service via unknown calls that trigger "undefined behavior." Aharon Chernin DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.2 IBM AIX 5.3 IBM AIX 6.1 at in bos.rte.cron on IBM AIX 5.2.0, 5.3.0 through 5.3.9, and 6.1.0 through 6.1.2 allows local users to read arbitrary files via unspecified vectors, related to failure to drop root privileges. Aharon Chernin DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.2 IBM AIX 5.3 IBM AIX 6.1 Multiple unspecified vulnerabilities in IBM AIX 5.2.0 through 6.1.2 allow local users to append data to arbitrary files, related to (1) rmsock and (2) rmsock64 not creating "secure log files." Aharon Chernin DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 The operating system installed on the system is IBM AIX version 5300-00. Aharon Chernin DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 The operating system installed on the system is IBM AIX version 5300-01 through 5300-06. Aharon Chernin DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.2 IBM AIX 5.3 IBM AIX 6.1 swcons in bos.rte.console in IBM AIX 5.2.0 through 6.1.1 allows local users in the system group to create or overwrite an arbitrary file, and establish weak permissions and root ownership for this file, via unspecified vectors. NOTE: this can be leveraged to gain privileges. NOTE: this issue exists because of an incomplete fix for CVE-2007-5805. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 Untrusted search path vulnerability in chnfsmnt in IBM AIX 6.1 allows local users to gain privileges via a modified PATH environment variable. Aharon Chernin DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.2 IBM AIX 5.3 IBM AIX 6.1 Buffer overflow in the uspchrp program in devices.chrp.base.diag in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 Buffer overflow in the kernel in IBM AIX 5.2, 5.3, and 6.1 allows local users to execute arbitrary code in kernel mode via unknown attack vectors. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 Buffer overflow in errpt in IBM AIX 5.2, 5.3, and 6.1 allows local users to gain privileges via unknown attack vectors. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.2 IBM AIX 5.3 IBM AIX 6.1 Buffer overflow in the pioout program in printers.rte in IBM AIX 5.2, 5.3, and 6.1 allows local users to gain privileges via a long command line option. Michael Wood DRAFT INTERIM ACCEPTED Aharon Chernin INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 The operating system installed on the system is IBM AIX version 5300-00 through 5300-05. Aharon Chernin DRAFT INTERIM ACCEPTED Shane Shaffer INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 crontab in bos.rte.cron in IBM AIX 6.1.0 through 6.1.2 allows local users with aix.system.config.cron authorization to gain privileges by launching an editor. Aharon Chernin DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.2 IBM AIX 5.3 IBM AIX 6.1 Buffer overflow in the utape program in devices.scsi.tape.diag in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.2 IBM AIX 5.3 IBM AIX 6.1 The lsmcode program on IBM AIX 5.2, 5.3, and 6.1 does not properly handle environment variables, which allows local users to gain privileges, a different vulnerability than CVE-2004-1329. Michael Wood DRAFT INTERIM ACCEPTED Michael Wood INTERIM ACCEPTED ACCEPTED IBM AIX 5.2 IBM AIX 5.3 IBM AIX 6.1 The nddstat programs on IBM AIX 5.2, 5.3, and 6.1 do not properly handle environment variables, which allows local users to gain privileges by invoking (1) atmstat, (2) entstat, (3) fddistat, (4) hdlcstat, or (5) tokstat. Michael Wood DRAFT INTERIM ACCEPTED Michael Wood INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 Unspecified vulnerability in iostat in IBM AIX 5.2, 5.3, and 6.1 allows local users to gain privileges via unknown vectors related to an "environment variable handling error." Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 Untrusted search path vulnerability in man in IBM AIX 6.1.0 allows local users to execute arbitrary code via a malicious program in the man directory. Yuzheng Zhou DRAFT INTERIM ACCEPTED Michael Wood INTERIM ACCEPTED ACCEPTED IBM AIX 5.2 IBM AIX 5.3 IBM AIX 6.1 The checkpoint and restart feature in the kernel in IBM AIX 5.2, 5.3, and 6.1 does not properly protect kernel memory, which allows local users to read and modify portions of memory and gain privileges via unspecified vectors involving a restart of a 64-bit process, probably related to the as_getadsp64 function. Michael Wood DRAFT INTERIM ACCEPTED Michael Wood INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 The operating system installed on the system is IBM AIX version 5300-07. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 The operating system installed on the system is IBM AIX version 6100-00. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.2 The operating system installed on the system is IBM AIX version 5200-10. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 The operating system installed on the system is IBM AIX version 5300-06. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Security. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to 2D. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, JavaFX 2.2.80, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via unknown vectors related to 2D. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-2590. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java SE Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect availability via vectors related to JNDI. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. Jaikumar DRAFT Jaikumar Kulkarni INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via unknown vectors related to 2D. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment. Puneeth DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Puneeth DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. Puneeth DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Puneeth DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. Jaikumar DRAFT Jaikumar Kulkarni INTERIM ACCEPTED Jaikumar Kulkarni INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The runtime linker in IBM AIX 6.1 and 7.1 and VIOS 2.2.x allows local users to create a mode-666 root-owned file, and consequently gain privileges, by setting crafted MALLOCOPTIONS and MALLOCBUCKETS environment-variable values and then executing a setuid program. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 tcpdump 3.8 through 4.6.2 might allow remote attackers to obtain sensitive information from memory or cause a denial of service (packet loss or segmentation fault) via a crafted Ad hoc On-Demand Distance Vector (AODV) packet, which triggers an out-of-bounds memory access. Jaikumar DRAFT Jaikumar Kulkarni INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33, allows remote attackers to affect confidentiality via vectors related to JMX. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. Jaikumar DRAFT Jaikumar Kulkarni INTERIM ACCEPTED Jaikumar Kulkarni INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 GSKit in IBM Tivoli Directory Server (ITDS) 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-ISS-ITDS-IF0035 and IBM Security Directory Server (ISDS) 6.3.1 before 6.3.1.9-ISS-ISDS-IF0009 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial "kadmind" substring, as demonstrated by a "ka/x" principal. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCMD_LQUERYLV environment-variable value. Puneeth DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 7.1 The operating system installed on the system is IBM AIX version 7100-03. Puneeth DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 The operating system installed on the system is IBM AIX version 6100-09. Puneeth DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JSSE. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS. Puneeth DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Jaikumar DRAFT DRAFT IBM AIX 6.1 IBM AIX 7.1 The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse. Jaikumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. Puneeth DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in the Java SE component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6585. Puneeth DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows remote attackers to affect availability via unknown vectors related to Security. Puneeth DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6493, CVE-2014-6503, and CVE-2014-6532. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Swing. Puneeth DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6503. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3, and R28.3.3 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8.0), 6 R1 before SR8 FP2 (6.1.8.2), 6 before SR16 FP2 (6.0.16.2), and before SR16 FP8 (5.0.16.8) allows local users to execute arbitrary code via vectors related to the shared classes cache. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Libraries. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function. Jaikumar DRAFT Jaikumar Kulkarni INTERIM ACCEPTED Jaikumar Kulkarni INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Libraries. Puneeth DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality via unknown vectors related to 2D. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect integrity via unknown vectors related to Libraries. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vectors related to the security manager. Puneeth DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Security. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Puneeth DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6493, and CVE-2014-6532. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access. Puneeth DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors reelated to 2D, a different vulnerability than CVE-2014-6591. Puneeth DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6527. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Libraries. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Firefox, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash), possibly execute arbitrary code, or have other unspecified impact via a crafted priority (PRI) value that triggers an out-of-bounds array access. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20, when running on Internet Explorer, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6476. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted handshake message. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The runtime linker in IBM AIX 6.1 and 7.1 and VIOS 2.2.x allows local users to create a mode-666 root-owned file, and consequently gain privileges, by setting crafted MALLOCOPTIONS and MALLOCBUCKETS environment-variable values and then executing a setuid program. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g, (2) A, or (3) B parameter. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation is enabled, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The runtime linker in IBM AIX 6.1 and 7.1 and VIOS 2.2.x allows local users to create a mode-666 root-owned file, and consequently gain privileges, by setting crafted MALLOCOPTIONS and MALLOCBUCKETS environment-variable values and then executing a setuid program. Manu M G DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service (traffic amplification) via DNS queries with spoofed source IP addresses. Prashant Kumar DRAFT INTERIM ACCEPTED Jaikumar Kulkarni INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition. Sushant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on a temporary file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2179. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake. Sushant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The ptrace system call in IBM AIX 5.3, 6.1, and 7.1, and VIOS 2.2.x, allows local users to cause a denial of service (system crash) or obtain sensitive information from kernel memory via a crafted PT_LDINFO operation. Sushant Kumar Singh DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value. Sushant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability. Sushant Kumar Singh DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment. Prashant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands via crafted input to an application that accepts translation strings from users, as demonstrated by the TWiki application before 5.1.3, and the Foswiki application 1.0.x through 1.0.10 and 1.1.x through 1.1.6. Sushant Kumar Singh DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 ftpd in IBM AIX 7.1.1 before SP10 and 7.1.2 before SP5, when a Workload Partition (aka WPAR) for AIX 5.2 or 5.3 is used, allows remote authenticated users to bypass intended permission settings and modify arbitrary files via FTP commands. Sushant Kumar Singh DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013. Prashant Kumar DRAFT INTERIM ACCEPTED Jaikumar Kulkarni INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment. Sushant Kumar DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 IBM AIX 7.1 The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c. Sushant Kumar Singh DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 IBM AIX 7.1 The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet data that provides a crafted callback address. Sushant Kumar Singh DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 IBM AIX 7.1 The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Next Protocol Negotiation record in a TLS handshake. Sushant Kumar Singh DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 IBM AIX 7.1 The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client. Sushant Kumar Singh DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure. Sushant Kumar Singh DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 CGI.pm module before 3.63 for Perl does not properly escape newlines in (1) Set-Cookie or (2) P3P headers, which might allow remote attackers to inject arbitrary headers into responses from applications that use CGI.pm. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The NFSv4 client implementation in IBM AIX 5.3, 6.1, and 7.1, and VIOS before 2.2.1.4-FP-25 SP-02, does not properly handle GID values, which allows remote attackers to cause a denial of service via unspecified vectors. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 BIND 9.6.0, 9.5.1, 9.5.0, 9.4.3, and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. Ganesh Manal DRAFT INTERIM ACCEPTED Jaikumar Kulkarni INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Multiple integer signedness errors in crypto/buffer/buffer.c in OpenSSL 0.9.8v allow remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2110. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 fuser in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly restrict the -k option, which allows local users to kill arbitrary processes via a crafted command line. Ganesh Manal DRAFT INTERIM Ganesh Manal ACCEPTED ACCEPTED IBM AIX 6.1 OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified impact and context-dependent attack vectors. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key. Ganesh Manal DRAFT INTERIM Ganesh Manal DEPRECATED DEPRECATED IBM AIX 6.1 IBM AIX 7.1 named in ISC BIND 9.6.2 before 9.6.2-P3, 9.6-ESV before 9.6-ESV-R3, and 9.7.x before 9.7.2-P3 does not properly handle the combination of signed negative responses and corresponding RRSIG records in the cache, which allows remote attackers to cause a denial of service (daemon crash) via a query for cached data. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The ProcRenderAddGlyphs function in the Render extension (render/render.c) in X.Org xserver 1.7.7 and earlier allows local users to read arbitrary memory and possibly cause a denial of service (server crash) via unspecified vectors related to an "input sanitization flaw." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via SSL cipher negotiation, as demonstrated by a chroot installation of Dovecot or stunnel without Kerberos configuration files inside the chroot. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 OpenSSL 0.9.8s and 1.0.0f does not properly support DTLS applications, which allows remote attackers to cause a denial of service (crash) via unspecified vectors related to an out-of-bounds read. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4108. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 IBM AIX 6.1 and 7.1 does not restrict the wpar_limits_config and wpar_limits_modify system calls, which allows local users to cause a denial of service (system crash) via a crafted call. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The kernel in IBM AIX 5.3, 6.1, and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly implement the dupmsg system call, which allows local users to cause a denial of service (system crash) via a crafted application. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Multiple integer overflows in X.Org Xserver before 1.4.1 allow context-dependent attackers to execute arbitrary code via (1) a GetVisualInfo request containing a 32-bit value that is improperly used to calculate an amount of memory for allocation by the EVI extension, or (2) a request containing values related to pixmap size that are improperly used in management of shared memory by the MIT-SHM extension. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 named in ISC BIND 9.x before 9.6.2-P3, 9.7.x before 9.7.2-P3, 9.4-ESV before 9.4-ESV-R4, and 9.6-ESV before 9.6-ESV-R3 does not properly determine the security status of an NS RRset during a DNSKEY algorithm rollover, which might allow remote attackers to cause a denial of service (DNSSEC validation error) by triggering a rollover. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819. NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022. Ganesh Manal DRAFT INTERIM ACCEPTED Jaikumar Kulkarni INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The implementation of Cryptographic Message Syntax (CMS) and PKCS #7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt data via a Million Message Attack (MMA) adaptive chosen ciphertext attack. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) via a malformed record in a TLS connection that triggers a NULL pointer dereference, related to the minor version number. NOTE: some of these details are obtained from third party information. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Integer underflow in OpenSSL before 0.9.8x, 1.0.0 before 1.0.0j, and 1.0.1 before 1.0.1c, when TLS 1.1, TLS 1.2, or DTLS is used with CBC encryption, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted TLS packet that is not properly handled during a certain explicit IV calculation. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 IBM AIX 5.3, 6.1, and 7.1, and VIOS 2.1.x and 2.2.x, allows remote attackers to cause a denial of service (system crash) via an ICMP Echo Reply packet that contains 1 in the Identifier field, a different vulnerability than CVE-2012-0194. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 librpc.dll in nsrexecd in EMC NetWorker before 7.5 SP4, 7.5.3.x before 7.5.3.5, and 7.6.x before 7.6.1.2 does not properly mitigate the possibility of a spoofed localhost source IP address, which allows remote attackers to (1) register or (2) unregister RPC services, and consequently cause a denial of service or obtain sensitive information from interprocess communication, via crafted UDP packets containing service commands. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Multiple race conditions in ssl/t1_lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi-threading and internal caching are enabled on a TLS server, might allow remote attackers to execute arbitrary code via client data that triggers a heap-based buffer overflow, related to (1) the TLS server name extension and (2) elliptic curve cryptography. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The TCP implementation in IBM AIX 5.3, 6.1, and 7.1, when the Large Send Offload option is enabled, allows remote attackers to cause a denial of service (assertion failure and panic) via an unspecified series of packets. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The socketpair function in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.1.4-FP-25 SP-02 allows local users to cause a denial of service (system crash) via a crafted application that leverages the presence of a socket on the free list. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 ssl/t1_lib.c in OpenSSL 0.9.8h through 0.9.8q and 1.0.0 through 1.0.0c allows remote attackers to cause a denial of service (crash), and possibly obtain sensitive information in applications that use OpenSSL, via a malformed ClientHello handshake message that triggers an out-of-bounds memory access, aka "OCSP stapling vulnerability." Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 CGI.pm module before 3.63 for Perl does not properly escape newlines in (1) Set-Cookie or (2) P3P headers, which might allow remote attackers to inject arbitrary headers into responses from applications that use CGI.pm. Ganesh Manal DRAFT INTERIM Ganesh Manal DEPRECATED DEPRECATED IBM AIX 6.1 IBM AIX 7.1 The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta does not properly validate DNSSEC (1) NSEC and (2) NSEC3 records, which allows remote attackers to add the Authenticated Data (AD) flag to a forged NXDOMAIN response for an existing domain. Ganesh Manal DRAFT INTERIM ACCEPTED Jaikumar Kulkarni INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The (1) bin/invscoutClient_VPD_Survey and (2) sbin/invscout_lsvpd programs in invscout.rte before 2.2.0.19 on IBM AIX 7.1, 6.1, 5.3, and earlier allow local users to delete arbitrary files, or trigger inventory scout operations on arbitrary files, via a symlink attack on an unspecified file. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The default configuration of sendmail in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, allows local users to gain privileges by entering a command in a .forward file in a home directory. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The XInput extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to execute arbitrary code via requests related to byte swapping and heap corruption within multiple functions, a different vulnerability than CVE-2007-4990. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The mime_param_cmp function in crypto/asn1/asn_mime.c in OpenSSL before 0.9.8u and 1.x before 1.0.0h allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message, a different vulnerability than CVE-2006-7250. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The getpwnam function in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.1.0.10 through 2.2.1.3 does not properly interact with customer-extended LDAP user filtering, which allows local users to gain privileges via unspecified vectors. Ganesh Manal DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error logging, and the caching of an invalid record by the resolver. Ganesh Manal DRAFT INTERIM ACCEPTED Jaikumar Kulkarni INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 IBM AIX 7.1 ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records. Chandan M C DRAFT INTERIM ACCEPTED ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The FTP client in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly manage privileges in an RBAC environment, which allows attackers to bypass intended file-read restrictions by leveraging the setuid installation of the ftp executable file. Chandan M C DRAFT INTERIM ACCEPTED ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 IBM AIX 7.1 The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue. Chandan M C DRAFT Chandan M C INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The TFTP client in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, when RBAC is enabled, allows remote authenticated users to bypass intended file-ownership restrictions, and read or overwrite arbitrary files, via unspecified vectors. Chandan M C DRAFT INTERIM ACCEPTED ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 IBM AIX 7.1 The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections. Chandan M C DRAFT INTERIM ACCEPTED ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 IBM AIX 7.1 Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor. Chandan M C DRAFT INTERIM ACCEPTED ACCEPTED ACCEPTED IBM AIX 6.1 The operating system installed on the system is IBM AIX version 6100-05. Chandan M C DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 IBM AIX 7.1 OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key. Chandan M C DRAFT Chandan M C INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 The operating system installed on the system is IBM AIX 6.1. Michael Wood Michael Wood DRAFT Michael Wood INTERIM ACCEPTED Chandan M C INTERIM ACCEPTED ACCEPTED IBM AIX 7.1 The operating system installed on the system is IBM AIX 7.1. Chandan M C DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 The IPv6 implementation in the inet subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, allows remote attackers to cause a denial of service (system hang) via a crafted packet to an IPv6 interface. Chandan M C DRAFT INTERIM ACCEPTED ACCEPTED ACCEPTED IBM AIX 6.1 IBM AIX 7.1 Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, allow local users to gain privileges via vectors involving (1) arp.ib or (2) ibstat. Chandan M C DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 The operating system installed on the system is IBM AIX version 6100-06. Chandan M C DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 7.1 The operating system installed on the system is IBM AIX version 7100-00. Chandan M C DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 IBM AIX 7.1 Multiple buffer overflows in (1) mkque and (2) mkquedev in bos.rte.printers in IBM AIX 6.1 and 7.1 allow local users to gain privileges by leveraging printq group membership. Chandan M C DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 7.1 The operating system installed on the system is IBM AIX version 7100-02. Chandan M C DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 The operating system installed on the system is IBM AIX version 6100-08. Chandan M C DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 The operating system installed on the system is IBM AIX version 6100-07. Chandan M C DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 7.1 The operating system installed on the system is IBM AIX version 7100-01. Chandan M C DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 The operating system installed on the system is IBM AIX version 7100-02. Chandan M C DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 Buffer overflow in sa_snap in the bos.esagent fileset in IBM AIX 6.1, 5.3, and earlier and VIOS 2.1, 1.5, and earlier allows local users to leverage system group membership and gain privileges via unspecified vectors. Yamini Mohan R DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons. Yamini Mohan R DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 The operating system installed on the system is IBM AIX version 5300-08. Michael Wood DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 IBM AIX 6.1 Format string vulnerability in the _msgout function in rpc.pcnfsd in IBM AIX 6.1, 5.3, and earlier; IBM VIOS 2.1, 1.5, and earlier; NFS/ONCplus B.11.31_09 and earlier on HP HP-UX B.11.11, B.11.23, and B.11.31; and SGI IRIX 6.5 allows remote attackers to execute arbitrary code via an RPC request containing format string specifiers in an invalid directory name. Varun Narula DRAFT INTERIM ACCEPTED R, Yamini Mohan INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 The operating system installed on the system is IBM AIX version 5300-09. Aharon Chernin DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 Buffer overflow in qoslist in bos.net.tcp.server in IBM AIX 6.1 and VIOS 2.1 allows local users to gain privileges via unspecified vectors. Varun Narula DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 The operating system installed on the system is IBM AIX version 6100-01. Aharon Chernin DRAFT Aharon Chernin INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, and 9.7 beta before 9.7.0b3, with DNSSEC validation enabled and checking disabled (CD), allows remote attackers to conduct DNS cache poisoning attacks by receiving a recursive client query and sending a response that contains an Additional section with crafted data, which is not properly handled when the response is processed "at the same time as requesting DNSSEC records (DO)," aka Bug 20438. Varun Narula DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 The operating system installed on the system is IBM AIX version 6100-04. J. Daniel Brown DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 The operating system installed on the system is IBM AIX version 6100-03. J. Daniel Brown DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 6.1 The operating system installed on the system is IBM AIX version 6100-02. Aharon Chernin DRAFT Aharon Chernin INTERIM ACCEPTED ACCEPTED IBM AIX 5.2 IBM AIX 5.3 IBM AIX 6.1 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue. Yamini Mohan R DRAFT INTERIM ACCEPTED ACCEPTED IBM AIX 5.3 The operating system installed on the system is IBM AIX 5.3. Yuzheng Zhou DRAFT INTERIM ACCEPTED Michael Wood INTERIM Michael Wood ACCEPTED ACCEPTED IBM AIX 5.2 The operating system installed on the system is IBM AIX 5.2. Yuzheng Zhou DRAFT INTERIM ACCEPTED Michael Wood INTERIM Michael Wood ACCEPTED ACCEPTED