SB2025062414 - Multiple vulnerabilities in IBM Storage Protect Backup-Archive Client



SB2025062414 - Multiple vulnerabilities in IBM Storage Protect Backup-Archive Client

Published: June 24, 2025 Updated: August 22, 2025

Security Bulletin ID SB2025062414
Severity
Medium
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 36% Low 64%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 secuirty vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2024-21235)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


2) Improper input validation (CVE-ID: CVE-2024-21217)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Serialization component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.


3) Improper input validation (CVE-ID: CVE-2024-21210)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle Java SE. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.


4) Improper input validation (CVE-ID: CVE-2024-21208)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Networking component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.


5) Integer overflow (CVE-ID: CVE-2024-10917)

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to return of an incorrect value which has wrapped around by the JNI function GetStringUTFLength. A remote attacker can pass specially crafted data to the application, trigger integer overflow and bypass security restrictions.


6) NULL pointer dereference (CVE-ID: CVE-2025-1470)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to some OMR internal port library and utilities consumers of z/OS atoe functions do not check their return values for NULL memory pointers or for memory allocation failures. A local user can pass specially crafted data to the application and perform a denial of service (DoS) attack.


7) Out-of-bounds write (CVE-ID: CVE-2025-1471)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to some of the z/OS atoe print functions use a constant length buffer for string conversion. If the input format string and arguments are larger than the buffer size then buffer overflow occurs. A remote attacker can send a specially crafted file, trigger an out-of-bounds write and execute arbitrary code on the target system.


8) Resource management error (CVE-ID: CVE-2024-47535)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an unsafe reading of an environment file on Windows. A local user can create an overly large file and perform a denial of service (DoS) attack.


9) Resource exhaustion (CVE-ID: CVE-2025-25193)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to application attempts to load a file that does not exist. A local user can create a large file on the system and crash the application.

Note, the vulnerability affects Windows installations only.


10) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2024-40094)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to GraphQL Java (aka graphql-java) does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


11) Resource exhaustion (CVE-ID: CVE-2025-23184)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in CachedOutputStream instances allowing creation of enormous amount of temporary files. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Remediation

Install update from vendor's website.