SB2025090821 - Multiple vulnerabilities in IBM Cloud Pak System
Published: September 8, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Incorrect default permissions (CVE-ID: CVE-2024-23454)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to the RunJar.run() method does not set permissions for temporary directory by default. A local user with access to the system can view contents of files and directories.
2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2025-3050)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper allocation of CPU resources. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.
3) Uncontrolled Memory Allocation (CVE-ID: CVE-2025-2518)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.
4) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2025-0915)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient release of allocated memory resources. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.
5) Memory leak (CVE-ID: CVE-2025-1992)
The vulnerability allows a remote user to perform DoS attack on the target system.
The vulnerability exists due to insufficient release of allocated memory after usage. A remote user can force the application to leak memory and perform denial of service attack.
6) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2025-1000)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper handling of automatic client rerouting when connecting to a z/OS database. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.