## Summary
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information via an out-of-bounds read (CWE-125). IBM rates the issue 7.7 (CVSS:3.1) and provides fix PTFs for each affected release.
## Technical Details
- Vulnerability type: out-of-bounds read (CWE-125).
- Result: disclosure of sensitive information (confidentiality impact C:H).
- Access model: remote authenticated attacker (PR:L, AV:N, AC:L, UI:N).
- Scope: S:C (changed scope), with no integrity or availability impact indicated (I:N, A:N).
## Affected
- IBM i 7.6 (5770-999)
- IBM i 7.5 (5770-999)
- IBM i 7.4 (5770-999)
- IBM i 7.3 (5770-999)
## Impact
- Sensitive information exposure to a remote authenticated attacker.
- No integrity or availability impact is indicated in the provided CVSS vector.
## Mitigation
1. Apply the IBM i PTFs listed in the IBM security bulletin:
- 7.6: MJ10974
- 7.5: MJ10973
- 7.4: MJ10972
- 7.3: MJ10971
2. If running unsupported IBM i versions, upgrade to a supported and fixed version as recommended by IBM.
3. Note: IBM lists no workarounds/mitigations for this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE-125