The version of AIX installed on the remote host is prior to APAR IJ4442. It is, therefore, affected by a vulnerability as referenced in the IJ4442 advisory.

  - The code that processes control channel messages sent to `named` calls certain functions recursively     during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on     the environment, this may cause the packet-parsing code to run out of available stack memory, causing     `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its     contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key;
    only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9     versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through     9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1. (CVE-2023-3341)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ4909. It is, therefore, affected by a vulnerability as referenced in the IJ4909 advisory.

  - The code that processes control channel messages sent to `named` calls certain functions recursively     during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on     the environment, this may cause the packet-parsing code to run out of available stack memory, causing     `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its     contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key;
    only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9     versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through     9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1. (CVE-2023-3341)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ50428. It is, therefore, affected by a vulnerability as referenced in the IJ50428 advisory.

  - sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a     published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing     bypass of an SPF protection mechanism. This occurs because sendmail supports <LF>.<CR><LF> but some other     popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.
    (CVE-2023-51765)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ50424. It is, therefore, affected by a vulnerability as referenced in the IJ50424 advisory.

  - sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a     published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing     bypass of an SPF protection mechanism. This occurs because sendmail supports <LF>.<CR><LF> but some other     popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.
    (CVE-2023-51765)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ50635. It is, therefore, affected by a vulnerability as referenced in the IJ50635 advisory.

  - An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader     interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to     an xmlValidatePopElement use-after-free. (CVE-2024-25062)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ50433. It is, therefore, affected by a vulnerability as referenced in the IJ50433 advisory.

  - sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a     published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing     bypass of an SPF protection mechanism. This occurs because sendmail supports <LF>.<CR><LF> but some other     popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.
    (CVE-2023-51765)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ50910. It is, therefore, affected by a vulnerability as referenced in the IJ50910 advisory.

  - IBM AIX's Unix domain (AIX 7.2, 7.3, VIOS 3.1, and VIOS 4.1) datagram socket implementation could     potentially expose applications using Unix domain datagram sockets with SO_PEERID operation and may lead     to privilege escalation. IBM X-Force ID: 284903. (CVE-2024-27273)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ50827. It is, therefore, affected by a vulnerability as referenced in the IJ50827 advisory.

  - An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader     interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to     an xmlValidatePopElement use-after-free. (CVE-2024-25062)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ50936. It is, therefore, affected by a vulnerability as referenced in the IJ50936 advisory.

  - IBM AIX's Unix domain (AIX 7.2, 7.3, VIOS 3.1, and VIOS 4.1) datagram socket implementation could     potentially expose applications using Unix domain datagram sockets with SO_PEERID operation and may lead     to privilege escalation. IBM X-Force ID: 284903. (CVE-2024-27273)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ50432. It is, therefore, affected by a vulnerability as referenced in the IJ50432 advisory.

  - sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a     published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing     bypass of an SPF protection mechanism. This occurs because sendmail supports <LF>.<CR><LF> but some other     popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.
    (CVE-2023-51765)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ50935. It is, therefore, affected by a vulnerability as referenced in the IJ50935 advisory.

  - IBM AIX's Unix domain (AIX 7.2, 7.3, VIOS 3.1, and VIOS 4.1) datagram socket implementation could     potentially expose applications using Unix domain datagram sockets with SO_PEERID operation and may lead     to privilege escalation. IBM X-Force ID: 284903. (CVE-2024-27273)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ50602. It is, therefore, affected by a vulnerability as referenced in the IJ50602 advisory.

  - An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader     interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to     an xmlValidatePopElement use-after-free. (CVE-2024-25062)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ50601. It is, therefore, affected by a vulnerability as referenced in the IJ50601 advisory.

  - An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader     interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to     an xmlValidatePopElement use-after-free. (CVE-2024-25062)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ50934. It is, therefore, affected by a vulnerability as referenced in the IJ50934 advisory.

  - IBM AIX's Unix domain (AIX 7.2, 7.3, VIOS 3.1, and VIOS 4.1) datagram socket implementation could     potentially expose applications using Unix domain datagram sockets with SO_PEERID operation and may lead     to privilege escalation. IBM X-Force ID: 284903. (CVE-2024-27273)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45175 IBM AIX could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel extension to cause a denial of service. IBM AIX could allow a non-privileged local user to exploit a vulnerability in the NFS kernel extension to cause a denial of service. IBM AIX could allow a non-privileged local user to exploit a vulnerability in the pmsvcs kernel extension to cause a denial of service. IBM AIX could allow a non-privileged local user to exploit a vulnerability in the kernel to cause a denial of service.

The version of AIX installed on the remote host is prior to APAR IJ48608. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ48608 advisory.

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     TCP/IP kernel extension to cause a denial of service. IBM X-Force ID: 267973. (CVE-2023-45175)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     NFS kernel extension to cause a denial of service. IBM X-Force ID: 267971. (CVE-2023-45173)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     pmsvcs kernel extension to cause a denial of service. IBM X-Force ID: 267967. (CVE-2023-45169)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     kernel to cause a denial of service. IBM X-Force ID: 267969. (CVE-2023-45171)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ48737. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ48737 advisory.

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     TCP/IP kernel extension to cause a denial of service. IBM X-Force ID: 267973. (CVE-2023-45175)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     NFS kernel extension to cause a denial of service. IBM X-Force ID: 267971. (CVE-2023-45173)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     pmsvcs kernel extension to cause a denial of service. IBM X-Force ID: 267967. (CVE-2023-45169)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     kernel to cause a denial of service. IBM X-Force ID: 267969. (CVE-2023-45171)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ48741. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ48741 advisory.

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     TCP/IP kernel extension to cause a denial of service. IBM X-Force ID: 267973. (CVE-2023-45175)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     NFS kernel extension to cause a denial of service. IBM X-Force ID: 267971. (CVE-2023-45173)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     pmsvcs kernel extension to cause a denial of service. IBM X-Force ID: 267967. (CVE-2023-45169)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     kernel to cause a denial of service. IBM X-Force ID: 267969. (CVE-2023-45171)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ48735. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ48735 advisory.

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     TCP/IP kernel extension to cause a denial of service. IBM X-Force ID: 267973. (CVE-2023-45175)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     NFS kernel extension to cause a denial of service. IBM X-Force ID: 267971. (CVE-2023-45173)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     pmsvcs kernel extension to cause a denial of service. IBM X-Force ID: 267967. (CVE-2023-45169)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     kernel to cause a denial of service. IBM X-Force ID: 267969. (CVE-2023-45171)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ48724. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ48724 advisory.

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     TCP/IP kernel extension to cause a denial of service. IBM X-Force ID: 267973. (CVE-2023-45175)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     NFS kernel extension to cause a denial of service. IBM X-Force ID: 267971. (CVE-2023-45173)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     pmsvcs kernel extension to cause a denial of service. IBM X-Force ID: 267967. (CVE-2023-45169)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     kernel to cause a denial of service. IBM X-Force ID: 267969. (CVE-2023-45171)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ48671. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ48671 advisory.

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     TCP/IP kernel extension to cause a denial of service. IBM X-Force ID: 267973. (CVE-2023-45175)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     NFS kernel extension to cause a denial of service. IBM X-Force ID: 267971. (CVE-2023-45173)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     pmsvcs kernel extension to cause a denial of service. IBM X-Force ID: 267967. (CVE-2023-45169)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     kernel to cause a denial of service. IBM X-Force ID: 267969. (CVE-2023-45171)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ48618. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ48618 advisory.

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     TCP/IP kernel extension to cause a denial of service. IBM X-Force ID: 267973. (CVE-2023-45175)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     NFS kernel extension to cause a denial of service. IBM X-Force ID: 267971. (CVE-2023-45173)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     pmsvcs kernel extension to cause a denial of service. IBM X-Force ID: 267967. (CVE-2023-45169)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     kernel to cause a denial of service. IBM X-Force ID: 267969. (CVE-2023-45171)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ48725. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ48725 advisory.

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     TCP/IP kernel extension to cause a denial of service. IBM X-Force ID: 267973. (CVE-2023-45175)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     NFS kernel extension to cause a denial of service. IBM X-Force ID: 267971. (CVE-2023-45173)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     pmsvcs kernel extension to cause a denial of service. IBM X-Force ID: 267967. (CVE-2023-45169)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     kernel to cause a denial of service. IBM X-Force ID: 267969. (CVE-2023-45171)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ48663. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ48663 advisory.

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     TCP/IP kernel extension to cause a denial of service. IBM X-Force ID: 267973. (CVE-2023-45175)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     NFS kernel extension to cause a denial of service. IBM X-Force ID: 267971. (CVE-2023-45173)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     pmsvcs kernel extension to cause a denial of service. IBM X-Force ID: 267967. (CVE-2023-45169)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     kernel to cause a denial of service. IBM X-Force ID: 267969. (CVE-2023-45171)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ48540. It is, therefore, affected by a vulnerability as referenced in the IJ48540 advisory.

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in AIX     windows to cause a denial of service. IBM X-Force ID: 267970. (CVE-2023-45172)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ48758. It is, therefore, affected by a vulnerability as referenced in the IJ48758 advisory.

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in AIX     windows to cause a denial of service. IBM X-Force ID: 267970. (CVE-2023-45172)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3341 ISC BIND is vulnerable to a denial of service, caused by a stack exhaustion flaw in control channel code. By sending a specially crafted message over the control channel, a remote attacker could exploit this vulnerability to cause named to terminate.

The version of AIX installed on the remote host is prior to APAR IJ48481. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ48481 advisory.

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     piodmgrsu command to obtain elevated privileges. IBM X-Force ID: 267964. (CVE-2023-45166)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a privileged local user to exploit a vulnerability in the     qdaemon command to escalate privileges or cause a denial of service. IBM X-Force ID: 267972.
    (CVE-2023-45174)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     piobe command to escalate privileges or cause a denial of service. IBM X-Force ID: 267968.
    (CVE-2023-45170)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ48784. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ48784 advisory.

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     piodmgrsu command to obtain elevated privileges. IBM X-Force ID: 267964. (CVE-2023-45166)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a privileged local user to exploit a vulnerability in the     qdaemon command to escalate privileges or cause a denial of service. IBM X-Force ID: 267972.
    (CVE-2023-45174)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     piobe command to escalate privileges or cause a denial of service. IBM X-Force ID: 267968.
    (CVE-2023-45170)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ48539. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ48539 advisory.

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     piodmgrsu command to obtain elevated privileges. IBM X-Force ID: 267964. (CVE-2023-45166)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a privileged local user to exploit a vulnerability in the     qdaemon command to escalate privileges or cause a denial of service. IBM X-Force ID: 267972.
    (CVE-2023-45174)

  - IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the     piobe command to escalate privileges or cause a denial of service. IBM X-Force ID: 267968.
    (CVE-2023-45170)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ47630. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ47630 advisory.

  - An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML     document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic     and memory errors, such as a double free. This behavior occurs because there is an attempt to use the     first byte of an empty string, and any value is possible (not solely the '\0' value). (CVE-2023-29469)

  - In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference     and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c. (CVE-2023-28484)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ47597. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ47597 advisory.

  - An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML     document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic     and memory errors, such as a double free. This behavior occurs because there is an attempt to use the     first byte of an empty string, and any value is possible (not solely the '\0' value). (CVE-2023-29469)

  - In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference     and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c. (CVE-2023-28484)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37434 zlib is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by inflate in inflate.c. By using a large gzip header extra field, a remote attacker could overflow a buffer and execute arbitrary code on the system.

The version of AIX installed on the remote host is prior to APAR IJ47629. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ47629 advisory.

  - An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML     document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic     and memory errors, such as a double free. This behavior occurs because there is an attempt to use the     first byte of an empty string, and any value is possible (not solely the '\0' value). (CVE-2023-29469)

  - In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference     and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c. (CVE-2023-28484)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ45059. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ45059 advisory.

  - An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a     hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be     provoked. (CVE-2022-40304)

  - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the     XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to     access an array at a negative 2GB offset, typically leading to a segmentation fault. (CVE-2022-40303)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40304 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40304 Gnome ibxml2 could allow a remote attacker to execute arbitrary code on the system, caused by a dict corruption flaw. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. Gnome libxml2 could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in the XML_PARSE_HUGE function. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.

The version of AIX installed on the remote host is prior to APAR IJ45224. It is, therefore, affected by a vulnerability as referenced in the IJ45224 advisory.

  - Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and     other products, does not verify that the server hostname matches a domain name in the subject's Common     Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid certificate. (CVE-2012-5783)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ44562. It is, therefore, affected by a vulnerability as referenced in the IJ44562 advisory.

  - IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a local user with elevated privileges to exploit a     vulnerability in the lpd daemon to cause a denial of service. IBM X-Force ID: 238641. (CVE-2022-43382)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ44994. It is, therefore, affected by a vulnerability as referenced in the IJ44994 advisory.

  - Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and     other products, does not verify that the server hostname matches a domain name in the subject's Common     Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid certificate. (CVE-2012-5783)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ45997. It is, therefore, affected by a vulnerability as referenced in the IJ45997 advisory.

  - IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in     the AIX runtime services library to execute arbitrary commands. IBM X-Force ID: 248421. (CVE-2023-26286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ45221. It is, therefore, affected by a vulnerability as referenced in the IJ45221 advisory.

  - Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and     other products, does not verify that the server hostname matches a domain name in the subject's Common     Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid certificate. (CVE-2012-5783)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ45245. It is, therefore, affected by a vulnerability as referenced in the IJ45245 advisory.

  - IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in     the AIX runtime services library to execute arbitrary commands. IBM X-Force ID: 248421. (CVE-2023-26286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ45981. It is, therefore, affected by a vulnerability as referenced in the IJ45981 advisory.

  - IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in     the AIX runtime services library to execute arbitrary commands. IBM X-Force ID: 248421. (CVE-2023-26286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ44987. It is, therefore, affected by a vulnerability as referenced in the IJ44987 advisory.

  - Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and     other products, does not verify that the server hostname matches a domain name in the subject's Common     Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid certificate. (CVE-2012-5783)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ45246. It is, therefore, affected by a vulnerability as referenced in the IJ45246 advisory.

  - IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in     the AIX runtime services library to execute arbitrary commands. IBM X-Force ID: 248421. (CVE-2023-26286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
209561	AIX (IJ4442)	high
209560	AIX (IJ4909)	high
195317	AIX (IJ50428)	medium
195316	AIX (IJ50424)	medium
195315	AIX (IJ50635)	high
195314	AIX (IJ50433)	medium
195313	AIX (IJ50910)	high
195312	AIX (IJ50827)	high
195311	AIX (IJ50936)	high
195310	AIX (IJ50432)	medium
195309	AIX (IJ50935)	high
195308	AIX (IJ50602)	high
195307	AIX (IJ50601)	high
195306	AIX (IJ50934)	high
187998	AIX 3.1 TL 3 : kernel (IJ49533)	medium
187997	AIX : Multiple Vulnerabilities (IJ48608)	medium
187996	AIX 3.1 TL 3 : kernel (IJ49534)	medium
187995	AIX 3.1 TL 3 : kernel (IJ49202)	medium
187994	AIX : Multiple Vulnerabilities (IJ48737)	medium
187993	AIX : Multiple Vulnerabilities (IJ48741)	medium
187992	AIX : Multiple Vulnerabilities (IJ48735)	medium
187991	AIX : Multiple Vulnerabilities (IJ48724)	medium
187990	AIX : Multiple Vulnerabilities (IJ48671)	medium
187989	AIX : Multiple Vulnerabilities (IJ48618)	medium
187988	AIX : Multiple Vulnerabilities (IJ48725)	medium
187987	AIX : Multiple Vulnerabilities (IJ48663)	medium
187173	AIX (IJ48540)	medium
187172	AIX (IJ48758)	medium
187171	AIX 7.2 TL 5 : bind (IJ49093)	high
187170	AIX : Multiple Vulnerabilities (IJ48481)	high
187169	AIX : Multiple Vulnerabilities (IJ48784)	high
187168	AIX 7.2 TL 5 : bind (IJ44424)	high
187167	AIX : Multiple Vulnerabilities (IJ48539)	high
178849	AIX : Multiple Vulnerabilities (IJ47630)	medium
178848	AIX : Multiple Vulnerabilities (IJ47597)	medium
178847	AIX 7.3 TL 1 : zlib (IJ44986)	critical
178846	AIX 7.3 TL 0 : zlib (IJ46030)	critical
178845	AIX : Multiple Vulnerabilities (IJ47629)	medium
174455	AIX : Multiple Vulnerabilities (IJ45059)	high
174454	AIX 7.2 TL 5 : libxml2 (IJ45056)	high
174453	AIX 7.3 TL 1 : libxml2 (IJ45060)	high
174446	AIX (IJ45224)	low
174445	AIX (IJ44562)	medium
174444	AIX (IJ44994)	low
174443	AIX (IJ45997)	high
174442	AIX (IJ45221)	low
174441	AIX (IJ45245)	high
174440	AIX (IJ45981)	high
174439	AIX (IJ44987)	low
174438	AIX (IJ45246)	high

Detections

Analytics

AIX Local Security Checks Family for Nessus

high

high

medium

medium

high

medium

high

high

high

medium

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

high

medium

medium

critical

critical

medium

high

high

high

low

medium

low

high

low

high

high

low

high