CERTA-2010-AVI-338

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été corrigées dans IBM Lotus Notes.

Description

Plusieurs vulnérabilités de type débordement de mémoire ont été corrigées dans IBM Lotus Notes. Celles-ci peuvent être exploitées par une personne malveillante afin d'exécuter du code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation). IBM ne propose pas de mise à jour pour les versions 5.0 et 6.5.6 et recommande le passage à une version ultérieure ou la désactivation des visualiseurs de fichiers concernés.

None
Impacted products
Vendor Product Description
N/A N/A IBM Lotus Notes 8.5x.
N/A N/A IBM Lotus Notes 5.0 ;
N/A N/A IBM Lotus Notes 7.0 ;
N/A N/A IBM Lotus Notes 6.5.6 ;
N/A N/A IBM Lotus Notes 8.0x ;
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM Lotus Notes 8.5x.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Lotus Notes 5.0 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Lotus Notes 7.0 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Lotus Notes 6.5.6 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Lotus Notes 8.0x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s de type d\u00e9bordement de m\u00e9moire ont \u00e9t\u00e9\ncorrig\u00e9es dans IBM Lotus Notes. Celles-ci peuvent \u00eatre exploit\u00e9es par\nune personne malveillante afin d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation). IBM ne propose pas de mise \u00e0\njour pour les versions 5.0 et 6.5.6 et recommande le passage \u00e0 une\nversion ult\u00e9rieure ou la d\u00e9sactivation des visualiseurs de fichiers\nconcern\u00e9s.\n",
  "cves": [
    {
      "name": "CVE-2010-1524",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1524"
    },
    {
      "name": "CVE-2010-1525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-1525"
    },
    {
      "name": "CVE-2010-0135",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0135"
    },
    {
      "name": "CVE-2010-0133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0133"
    },
    {
      "name": "CVE-2010-0131",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0131"
    },
    {
      "name": "CVE-2010-0126",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0126"
    }
  ],
  "links": [],
  "reference": "CERTA-2010-AVI-338",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-07-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans IBM Lotus Notes.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans IBM Lotus Notes",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM swg21440812 du 27 juillet 2010",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21440812"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.