SB2023011636 - IBM Tivoli Application Dependency Discovery Manager update for IBM SDK Java
Published: January 16, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2022-21541)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
2) Improper input validation (CVE-ID: CVE-2022-21540)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
3) Improper input validation (CVE-ID: CVE-2021-2163)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
4) Error Handling (CVE-ID: CVE-2021-41041)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to Java versions 8 and 11 fail to throw the exception captured during bytecode
verification when verification is triggered by a MethodHandle invocation. A remote attacker can invoke unverified methods using MethodHandles and bypass implemented security restrictions.
5) Type Confusion (CVE-ID: CVE-2022-3676)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to a type confusion error. A remote attacker can pass specially crafted data to the application, trigger a type confusion error and access or modify memory.
6) Improper input validation (CVE-ID: CVE-2022-21628)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The vulnerability exists due to improper input validation within the Lightweight HTTP Server component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.
7) Improper input validation (CVE-ID: CVE-2022-21626)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The vulnerability exists due to improper input validation within the Security component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.
8) Improper input validation (CVE-ID: CVE-2022-21624)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the JNDI component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
9) Improper input validation (CVE-ID: CVE-2022-21619)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the Security component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
Remediation
Install update from vendor's website.