SB2025120304 - Multiple vulnerabilities in IBM Guardium Data Security Center

Description

This security bulletin contains information about 84 secuirty vulnerabilities.

1) Command Injection (CVE-ID: CVE-2024-53899)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper input validation when handling magic templates strings in activation scripts. A local user can pass specially crafted value via an environment variable to the affected script and execute arbitrary OS commands on the system.

2) Input validation error (CVE-ID: CVE-2025-27516)

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to sandbox breakout through attr filter selecting format method. A local user can execute arbitrary code on the system.

3) Incorrect authorization (CVE-ID: CVE-2024-9902)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an error within the ansible-core `user` module. A local user can silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.

4) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2024-8775)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files. A local user can read the log files and gain access to sensitive data.

5) Code Injection (CVE-ID: CVE-2024-6345)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when processing URL in the package_index module of pypa/setuptools. A remote attacker can send a specially crafted request and execute arbitrary code on the target system via download functions.

6) Security features bypass (CVE-ID: CVE-2024-56326)

The vulnerability allows a local user to bypass sandbox restrictions.

The vulnerability exists in the way the Jinja sandboxed environment detects calls to str.format.  A local user with the ability to control the contents of a template can bypass sandbox restrictions.

7) Security features bypass (CVE-ID: CVE-2024-56201)

The vulnerability allows a local user to bypass sandbox restrictions.

The vulnerability exists due to improper validation of user-supplied input.  A local user with the ability to control both the filename and the contents of a template can bypass sandbox restrictions.

8) Infinite loop (CVE-ID: CVE-2024-5569)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop. A remote attacker can pass a specially crafted zip file to the application, consume all available system resources and cause denial of service conditions.

9) OS Command Injection (CVE-ID: CVE-2024-9287)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper input validation in the venv module when creating a virtual environment. A local user can pass specially crafted strings to the application and execute arbitrary OS commands on the target system.

10) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2024-52304)

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

11) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2025-53643)

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to not parsing trailer sections of an HTTP request. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

12) Memory leak (CVE-ID: CVE-2024-52303)

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak when a request produces a MatchInfoError. A remote attacker can force the application to leak memory and perform denial of service attack.

13) Insufficiently protected credentials (CVE-ID: CVE-2024-47081)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the library leaks .netrc credentials to third parties for specific maliciously-crafted URLs. A remote attacker can gain access to sensitive information. 

14) Improper Certificate Validation (CVE-ID: CVE-2024-39689)

The vulnerability allows a remote attacker to modify data on the system.

The vulnerability exists due to Certifi python-certifi provide weaker than expected security, caused by the use of GLOBALTRUST root certificate. A remote attacker can trigger the vulnerability to launch further attacks on the system.

15) Information disclosure (CVE-ID: CVE-2024-37891)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to Prox-Authorization header is not stripped during cross-origin redirects when using urllib3's proxy support with ProxyManager. A remote attacker can gain obtain proxy credentials used by the library.

16) NULL pointer dereference (CVE-ID: CVE-2024-26130)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

17) Security features bypass (CVE-ID: CVE-2024-11079)

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to application allows to use hostvars object to reference and execute templated content. A remote user can bypass unsafe content protections and execute arbitrary code if remote data or module outputs are improperly templated within playbooks.

18) Command Injection (CVE-ID: CVE-2023-5752)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper input validation when installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip. A remote attacker who controls the repository can use the specified Mercurial revision to inject arbitrary configuration options to the "hg clone" call (ie "--config").

19) Input validation error (CVE-ID: CVE-2023-29483)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the Tudoor mechanism. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

20) Path traversal (CVE-ID: CVE-2025-47273)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to input validation error when processing directory traversal sequences in package_index.py. A remote attacker can trick the victim into installing a specially crafted script and overwrite arbitrary files on the system, leading to code execution.

21) Integer overflow (CVE-ID: CVE-2021-43784)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in netlink bytemsg length field. A remote authenticated attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

22) CRLF injection (CVE-ID: CVE-2025-48384)

The vulnerability allows a remote user to compromise the affected system.

The vulnerability exists due to insufficient validation of attacker-supplied data when reading config values. A remote user can pass specially crafted config lines to the application containing CR-LF characters and execute arbitrary code on the system after checkout.

23) Input validation error (CVE-ID: CVE-2025-47906)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of the PATH environment variable in LookPath. A local user can pass specially crafted strings to the application and execute arbitrary OS commands with elevated privileges. 

24) Protection Mechanism Failure (CVE-ID: CVE-2025-41248)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the annotation detection mechanism does not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. A remote attacker can gain access to sensitive information. 

25) Protection Mechanism Failure (CVE-ID: CVE-2025-41249)

The vulnerability allows a remote attacker to gain access to sensitive information. 

The vulnerability exists due to the annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. A remote attacker can gain access to sensitive information. 

26) Command Injection (CVE-ID: CVE-2025-59419)

The vulnerability allows a remote attacker to execute arbitrary SMTP commands.

The vulnerability exists due to insufficient input validation in the SMTP codec. A remote attacker can pass specially crafted data to the application and forge arbitrary emails from the trusted server.

27) Out-of-bounds write (CVE-ID: CVE-2024-29133)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when calling the ListDelimiterHandler.flatten(Object, int) with a cyclical object tree. A remote attacker can pass specially crafted input to the application, trigger an out-of-bounds write and execute arbitrary code on the target system.

28) Out-of-bounds write (CVE-ID: CVE-2024-29131)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input. A remote attacker can pass specialy crafted data to the application, trigger an out-of-bounds write and execute arbitrary code on the target system.

29) Memory leak (CVE-ID: CVE-2025-58058)

The vulnerability allows a remote attacker to perform a DoS attack.

The vulnerability exists due memory leak when decoding corrupted LZMA archives. A remote attacker can force the application to leak memory and perform denial of service attack.

30) Missing initialization of resource (CVE-ID: CVE-2025-54410)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to Docker fails to re-create iptables rules that isolate bridge networks when firewalld reloads, allowing any container to access all ports on any other container across different bridge networks on the same host. This breaks network segmentation between containers that should be isolated, creating significant risk in multi-tenant environments. A local user can gain unauthorized access to sensitive information on the system.

31) Information disclosure (CVE-ID: CVE-2025-4673)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to sensitive Proxy-Authorization and Proxy-Authenticate headers are not cleared on cross-origin redirect in net/http. A remote attacker can gain access to credentials passed via these headers.

32) Command Injection (CVE-ID: CVE-2024-3154)

The vulnerability allows a remote user to execute arbitrary commands on the target system.

The vulnerability exists due to the systemd property injection. A remote administrator can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

33) Input validation error (CVE-ID: CVE-2025-22872)

The vulnerability allows a remote attacker to perform code injection attacks.

The vulnerability exists due to insufficient validation of tags with unquoted attribute values that end with a solidus character (/). The tokenizer can interpret such tags as self-closing, leading to content following such tags as being placed in the wrong scope during DOM construction.

34) Input validation error (CVE-ID: CVE-2025-22870)

The vulnerability allows a remote attacker to alter application's behavior.

The vulnerability exists due to insufficient validation of an IPv6 zone ID as a hostname component, when matching hosts against proxy patterns. For instance the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied. A remote attacker can alter application behavior and potentially  gain access to sensitive information or functionality.

35) Link following (CVE-ID: CVE-2025-0913)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an insecure link following issue within the os.OpenFile(path, os.O_CREATE|O_EXCL) method when handling dangling symlinks on Windows systems. A local user can create a specially crafted symbolic link and write arbitrary files to the system.

36) Race condition (CVE-ID: CVE-2024-45310)

The vulnerability allows a remote attacker to crate empty files and directories on the host.

The vulnerability exists due to a race condition when handling containers with custom configuration. A remote attacker can trick the victim into running a specially crafted Docker or Kubernetes container, which can be used to share a volume between two containers and then exploit a race with os.MkdirAll to create empty  files or directories in arbitrary locations in the host filesystem.

Successful exploitation of the vulnerability may allow an attacker to perform a denial of service attack against the host system.

37) Integer overflow (CVE-ID: CVE-2024-40635)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer overflow when handling a UID:GID larger than the maximum 32-bit signed integer. A local user can pass a large user identifier value to the application, trigger an integer overflow and execute arbitrary code on the target system.

38) Race condition (CVE-ID: CVE-2024-36623)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition in the streamformatter package. A local user can exploit the race and crash the application.

39) Race condition (CVE-ID: CVE-2024-36621)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition within builder/builder-next/adapters/snapshot/layer.go. A local user can exploit the race and perform a denial of service (DoS) attack.

40) NULL pointer dereference (CVE-ID: CVE-2024-36620)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in daemon/images/image_history.go. A local user can trigger crash the application.

41) Buffer overflow (CVE-ID: CVE-2025-9900)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing image files. A remote attacker can create a specially crafted image file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

42) Improper authentication (CVE-ID: CVE-2024-12797)

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to an error when using RFC7250 Raw Public Keys (RPKs) to authenticate a server. TLS and DTLS connections using raw public keys are vulnerable to man-in-middle attacks when server authentication failure is not detected by clients.

Note, the vulnerability can be exploited only when TLS clients explicitly enable RPK use by the server, and the server, likewise, enables sending of an RPK instead of an X.509 certificate chain.

43) Resource exhaustion (CVE-ID: CVE-2025-55163)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling HTTP/2 requests. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

44) Resource exhaustion (CVE-ID: CVE-2025-58187)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to quadratic complexity when checking name constraints in crypto/x509. A remote attacker can pass a specially crafted x509 certificate to the application and trigger resource exhaustion. 

45) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2025-58056)

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP/1.1 requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

46) Uncontrolled Recursion (CVE-ID: CVE-2025-48924)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. A remote attacker can trigger uncontrolled recursion and perform a denial of service (DoS) attack.

47) Information disclosure (CVE-ID: CVE-2025-22227)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to Reactor Netty HTTP client leaks credentials in some specific scenarios with chained redirects. A remote attacker can gain access to sensitive information. 

48) Resource exhaustion (CVE-ID: CVE-2025-58183)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in archive/tar due to the tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A remote attacker can pass a specially crafted archive to the application and perform a denial of service (DoS) attack.

49) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2025-58754)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to allocation of resources without limits within data: URL decode. A remote attacker can cause a denial of service condition on the target system.

50) Resource exhaustion (CVE-ID: CVE-2025-61724)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in net/textproto due to the Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. A remote attacker can trigger excessive CPU consumption and perform a denial of service (DoS) attack.

51) Resource exhaustion (CVE-ID: CVE-2025-61723)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in encoding/pem due to application does not properly control consumption of internal resources when parsing untrusted PEM input. A remote attacker can trigger CPU exhaustion and perform a denial of service (DoS) attack.

52) Improper Encoding or Escaping of Output (CVE-ID: CVE-2025-58189)

The vulnerability allows a remote attacker to perform spoofing attacks.

The vulnerability exists due to missing sanitization of input data when the Conn.Handshake fails during ALPN negotiation in crypto/tls. A remote attacker can pass specially crafted input via an error message and influence the application behavior, leading to a potential spoofing attack. 

53) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2025-58186)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in net/http due to the application does not limit the number of cookies sent in the request. A remote attacker can send a lot of very small cookies such as "a=;" and cause large memory consumption. 

54) Integer overflow (CVE-ID: CVE-2023-34453)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in shuffle. A remote attacker can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.

55) Resource exhaustion (CVE-ID: CVE-2025-58185)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in encoding/asn1 due to application does not properly control consumption of internal resources when parsing DER payloads. A remote attacker can trigger memory exhaustion and perform a denial of service (DoS) attack.

56) Input validation error (CVE-ID: CVE-2025-47912)

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists in net/url due to the Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. A remote attacker can abuse such behavior to perform spoofing attacks. 

57) Resource exhaustion (CVE-ID: CVE-2025-61725)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the ParseAddress function in net/mail does not properly control consumption of internal resources. A remote attacker can compose a specially crafted email message that triggers excessive CPU consumption leading to denial of service. 

58) Input validation error (CVE-ID: CVE-2025-58188)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in crypto/x509 due to an error when validating certificate chains which contain DSA public keys. A remote attacker can pass a specially crafted certificate to the application and crash it.

59) Resource exhaustion (CVE-ID: CVE-2025-61795)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling errors while processing multipart upload. Depending on JVM settings, application memory usage and application load, it is possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.

60) Improper Output Neutralization for Logs (CVE-ID: CVE-2025-55754)

The vulnerability allows a remote attacker to execute arbitrary OS commands.

The vulnerability exists due to improper input validation of ANSI escape sequences in log messages. A remote attacker can use a crafted URL to inject ANSI escape sequences to manipulate the console and the clip-boardand potentially execute arbitrary code.

The vulnerability affects Windows installations only.

61) Path traversal (CVE-ID: CVE-2025-55752)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to input validation error when processing directory traversal sequences passed via Rewrite Valve. A remote attacker can send a specially crafted HTTP PUT request and write arbitrary files to the server, leading to remote code execution. 

62) Resource exhaustion (CVE-ID: CVE-2025-58057)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in BrotliDecoder and some other decompressing decoders. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

63) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2025-8869)

The vulnerability allows a remote attacker to modify data on the system.

The vulnerability exists due to improper error handling. A remote attacker can trick the victim into opening a specially crafted data and modify data on the system.

64) Integer overflow (CVE-ID: CVE-2023-34454)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in compress. A remote attacker can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.

65) Link following (CVE-ID: CVE-2025-8941)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an insecure link following issue in the pam_namespace module. A local user can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application.

The vulnerability exists due to incomplete fix for #VU111389 (CVE-2025-6020).

66) Type Confusion (CVE-ID: CVE-2025-49796)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a type confusion error within the xmlSchematronFormatReport() function when processing sch:name elements in schematron.c. A remote attacker can pass specially crafted data to the application, trigger a type confusion error and crash the application. 

67) Improper access control (CVE-ID: CVE-2025-6020)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper access restrictions within the pam_namespace module when handling user-controlled paths. A local user can use specially crafted symlinks and race conditions to execute arbitrary code as root. 

68) Path traversal (CVE-ID: CVE-2025-4517)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to input validation error in the tarfile module when extracting files from an archive with filter="data". A remote attacker can pass specially crafted archive to the application and write files to arbitrary locations on the system outside the extraction directory.

69) Link following (CVE-ID: CVE-2025-4138)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to an insecure link following issue when extracting data from an archive in the tarfile module. A remote attacker can pass a specially crafted archive to the application and overwrite arbitrary files outside the destination directory during extraction with filter="data"..

70) Path traversal (CVE-ID: CVE-2024-12718)

The vulnerability allows a remote attacker to modify arbitrary files on the system.

The vulnerability exists due to input validation error in the tarfile module. A remote attacker can pass a specially crafted archive to the application and modify some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory.

71) Improper authentication (CVE-ID: CVE-2024-10963)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in pam_access module where certain rules in its configuration file are mistakenly treated as hostnames. A remote attacker can bypass authentication process and gain unauthorized access to the system.

72) Use-after-free (CVE-ID: CVE-2025-7425)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the xsltSetSourceNodeFlags() function. A remote attacker can pass specially crafted XML input to the application, trigger memory corruption and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

73) Buffer overflow (CVE-ID: CVE-2025-6965)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing aggregated terms. A remote attacker can pass specially crafted input to the application where the number of aggregate terms exceeds the number of columns available, trigger memory corruption and perform a denial of service (DoS) attack.

74) Double free (CVE-ID: CVE-2025-5914)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the archive_read_format_rar_seek_data() function. A remote attacker can pass specially crafted data to the application, trigger a double free error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

75) Use-after-free (CVE-ID: CVE-2025-49794)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the xmlSchematronGetNode() function when processing XPath expressions in Schematron schema elements schematron.c. A remote attacker can pass specially crafted XML input to the application and perform a denial of service (DoS) attack.

76) Resource exhaustion (CVE-ID: CVE-2023-34455)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

77) Memory corruption (CVE-ID: CVE-2017-9047)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the xmlSnprintfElementContent function of XMLSoft libxml2 due to improper memory handling by the valid.c source code. A remote attacker can send a specially crafted XML file, trigger memory corruption and cause the service to crash.

Successful exploitation of the vulnerability results in denial of service.

78) Stack-based buffer overflow (CVE-ID: CVE-2025-24928)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the xmlSnprintfElements() function in valid.c. A remote attacker can pass specially crafted XML data to the application, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

79) Use-after-free (CVE-ID: CVE-2024-56171)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the xmlSchemaIDCFillNodeTables() and xmlSchemaBubbleIDCNodeTables() functions in xmlschemas.c. A remote attacker can pass specially crafted XML document to the application, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

80) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2024-3596)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to use of a broken or risky cryptographic algorithm in RADIUS Protocol. A remote user can perform a man-in-the-middle (MitM) attack and gain access to target system.

81) Improper access control (CVE-ID: CVE-2025-48734)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions to enum properties. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().

82) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2025-27817)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in Apache Kafka Client. The application accepts configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

83) Information disclosure (CVE-ID: CVE-2024-31141)

The vulnerability allows a remote user to escalate privileges within the application.

The vulnerability exists due to the way Apache Kafka Clients handles custom configurations. A remote user with access to REST API can read arbitrary files and variables on the system and escalate their privileges filesystem/environment access.

84) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2023-43642)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to missing upper bound check on chunk length. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.ibm.com/support/pages/node/7253282