CVE-2018-1463
published 2018-05-17CVE-2018-1463: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7…
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
1.44%
70.1th percentile
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) could allow an authenticated user to access system files they should not have access to some of which could contain account credentials. IBM X-Force ID: 140368.
Affected
173 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | flashsystem_v9000 | — | — |
| ibm | flashsystem_v9000 | — | — |
| ibm | flashsystem_v9000 | — | — |
| ibm | flashsystem_v9000 | — | — |
| ibm | flashsystem_v9000 | — | — |
| ibm | flashsystem_v9000 | — | — |
| ibm | flashsystem_v9000 | — | — |
| ibm | flashsystem_v9000 | — | — |
| ibm | flashsystem_v9000 | — | — |
| ibm | flashsystem_v9000 | — | — |
| ibm | flashsystem_v9000 | — | — |
| ibm | flashsystem_v9000 | — | — |
| ibm | flashsystem_v9000 | — | — |
| ibm | flashsystem_v9000 | — | — |
| ibm | flashsystem_v9000 | — | — |
| ibm | flashsystem_v9000 | — | — |
| ibm | flashsystem_v9000 | — | — |
| ibm | san_volume_controller | — | — |
| ibm | san_volume_controller | — | — |
| ibm | san_volume_controller | — | — |
| ibm | san_volume_controller | — | — |
| ibm | san_volume_controller | — | — |
| ibm | san_volume_controller | — | — |
| ibm | san_volume_controller | — | — |
| ibm | san_volume_controller | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-16646 poppler: infinite recursion in Parser::getObj function in Parser.cc
bugzilla·2018-09-07·CVSS 6.5
CVE-2018-16646 [MEDIUM] CVE-2018-16646 poppler: infinite recursion in Parser::getObj function in Parser.cc
CVE-2018-16646 poppler: infinite recursion in Parser::getObj function in Parser.cc
A flaw was found in Poppler 0.68.0, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack.
References:
https://bugzilla.redhat.com/show_bug.cgi?id=1622951
Discussion:
Created mingw-poppler tracking bugs for this issue:
Affects: fedora-all [bug 1626621]
Created poppler tracking bugs for this issue:
Affects: fedora-all [bug 1626620]
---
Reproduces on RHEL-7.
```Syntax Error (1452): Dictionary key must be a name object
Syntax Error (1454): Dictionary key must be a name object
Syntax Error (1463): Dictionary key must be a name object
Syntax Error (1470): Dictionary key must be a name object
Syntax Error (1476):
Bugzilla
CVE-2018-2627 Oracle JDK: unspecified vulnerability fixed in 8u161 and 9.0.4 (Installer)
bugzilla·2018-01-17·CVSS 7.5
CVE-2018-2627 [HIGH] CVE-2018-2627 Oracle JDK: unspecified vulnerability fixed in 8u161 and 9.0.4 (Installer)
CVE-2018-2627 Oracle JDK: unspecified vulnerability fixed in 8u161 and 9.0.4 (Installer)
Oracle Java SE 8u161 and 9.0.4 fixes an unspecified vulnerability in the Installer component (CVE-2018-2627). Upstream has CVSS scored this issue as: 7.5/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
External Reference:
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixJAVA
Discussion:
This issue has been addressed in the following products:
Oracle Java for Red Hat Enterprise Linux 7
Oracle Java for Red Hat Enterprise Linux 6
Via RHSA-2018:0099 https://access.redhat.com/errata/RHSA-2018:0099
---
This issue has been addressed in the following products:
Red Hat Satellite 5.8
Via RHSA-2018:1463 https://access.redhat.com/errata/RHSA-2018:1463
http://www.ibm.com/support/docview.wss?uid=ssg1S1012263http://www.ibm.com/support/docview.wss?uid=ssg1S1012282http://www.ibm.com/support/docview.wss?uid=ssg1S1012283http://www.securityfocus.com/bid/104349https://exchange.xforce.ibmcloud.com/vulnerabilities/140368http://www.ibm.com/support/docview.wss?uid=ssg1S1012263http://www.ibm.com/support/docview.wss?uid=ssg1S1012282http://www.ibm.com/support/docview.wss?uid=ssg1S1012283http://www.securityfocus.com/bid/104349https://exchange.xforce.ibmcloud.com/vulnerabilities/140368
2018-05-17
Published