SB2025072811 - Multiple vulnerabilities in IBM Cloud Pak System
Published: July 28, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Deserialization of Untrusted Data (CVE-ID: CVE-2025-30065)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data within the parquet-avro module when parsing an Avro schema from a Parquet file metadata. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Uncontrolled Recursion (CVE-ID: CVE-2024-7254)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation when parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields. A remote attacker can pass specially crafted input to the application to create unbounded recursions and perform a denial of service (DoS) attack.
3) Stack-based buffer overflow (CVE-ID: CVE-2024-49350)
The vulnerability allows a remote user to perform a denial of service attack.
The vulnerability exists due to server may crash under certain conditions with a specially crafted query. A remote unauthenticated user can send a specially crafted query, trigger stack-based buffer overflow and perform a denial of service attack.
4) Improper Validation of Array Index (CVE-ID: CVE-2025-3357)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper validation of the index value of a dynamically allocated array. A remote attacker can trigger the vulnerability to execute arbitrary code on the system.
Remediation
Install update from vendor's website.