DSA-2025-071: Security update for Dell Avamar for Multiple Component Vulnerabilities.

요약: Dell Avamar remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.

이 문서는 다음에 적용됩니다. 이 문서는 다음에 적용되지 않습니다. 이 문서는 특정 제품과 관련이 없습니다. 모든 제품 버전이 이 문서에 나와 있는 것은 아닙니다.
기타 리소스 확인

영향

Critical

세부 정보

Third-party Component

CVEs

More Information

The FreeType Project

CVE-2022-27404, CVE-2017-10672

See NVD link below for individual scores for each CVE. 

https://nvd.nist.gov/This hyperlink is taking you to a website outside of Dell Technologies.

Dozer 

CVE-2014-9515

https://nvd.nist.gov/vuln/detail/cve-2014-9515This hyperlink is taking you to a website outside of Dell Technologies.

OpenSSH

CVE-2023-38408

https://nvd.nist.gov/vuln/detail/CVE-2023-38408This hyperlink is taking you to a website outside of Dell Technologies.

Curl

CVE-2018-0500, CVE-2018-14618, CVE-2018-16839, CVE-2018-16842, CVE-2019-3822, CVE-2019-5481

See NVD link below for individual scores for each CVE. 

https://nvd.nist.gov/This hyperlink is taking you to a website outside of Dell Technologies.

jackson-databind

CVE-2019-14379, CVE-2019-14540, CVE-2019-16335, CVE-2019-16942, CVE-2019-16943, CVE-2019-17267, CVE-2019-17531, CVE-2019-20330, CVE-2020-8840, CVE-2020-9547, CVE-2020-9548, CVE-2020-10672, CVE-2020-10968, CVE-2020-10969, CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-11619, CVE-2020-11620, CVE-2020-14061, CVE-2020-14062, CVE-2020-14060, CVE-2020-14195, CVE-2020-25649

See NVD link below for individual scores for each CVE. 

https://nvd.nist.gov/This hyperlink is taking you to a website outside of Dell Technologies.

POCO C++ Libraries

CVE-2023-52389, CVE-2017-1000472

See NVD link below for individual scores for each CVE. 

https://nvd.nist.gov/This hyperlink is taking you to a website outside of Dell Technologies.

mailx

CVE-2014-7844

https://nvd.nist.gov/vuln/detail/CVE-2014-7844This hyperlink is taking you to a website outside of Dell Technologies.

OpenSSL

CVE-2011-4109

https://nvd.nist.gov/vuln/detail/CVE-2011-4109This hyperlink is taking you to a website outside of Dell Technologies.

file

CVE-2019-18218

https://nvd.nist.gov/vuln/detail/CVE-2019-18218This hyperlink is taking you to a website outside of Dell Technologies.

TestNG

CVE-2022-4065

https://nvd.nist.gov/vuln/detail/CVE-2022-4065This hyperlink is taking you to a website outside of Dell Technologies.

Linux Kernel

CVE-2017-1000112

https://nvd.nist.gov/vuln/detail/CVE-2017-1000112This hyperlink is taking you to a website outside of Dell Technologies.

Cyrus SASL

CVE-2019-19906, CVE-2022-24407, CVE-2013-4122

See NVD link below for individual scores for each CVE. 

https://nvd.nist.gov/This hyperlink is taking you to a website outside of Dell Technologies.

libffi

CVE-2017-1000376

https://nvd.nist.gov/vuln/detail/CVE-2017-1000376This hyperlink is taking you to a website outside of Dell Technologies.

Gstreamer

CVE-2021-3497, CVE-2021-3498, CVE-2022-1924, CVE-2022-1920, CVE-2022-1921, CVE-2022-1925, CVE-2022-2122, CVE-2021-3522, CVE-2006-4339, CVE-2022-1922, CVE-2022-1923

See NVD link below for individual scores for each CVE. 

https://nvd.nist.gov/This hyperlink is taking you to a website outside of Dell Technologies.

e2fsprogs

CVE-2019-5188

https://nvd.nist.gov/vuln/detail/CVE-2019-5188This hyperlink is taking you to a website outside of Dell Technologies.

elfutils

CVE-2018-18520

https://nvd.nist.gov/vuln/detail/CVE-2018-18520This hyperlink is taking you to a website outside of Dell Technologies.

JBIG-KIT lossless image compression library 2

CVE-2013-6369

https://nvd.nist.gov/vuln/detail/CVE-2013-6369This hyperlink is taking you to a website outside of Dell Technologies.

Jetty: Java based HTTP/1.x, HTTP/2, Servlet, WebSocket Server

CVE-2021-34429

https://nvd.nist.gov/vuln/detail/CVE-2021-34429This hyperlink is taking you to a website outside of Dell Technologies.

libpng

CVE-2019-7317

https://nvd.nist.gov/vuln/detail/CVE-2019-7317This hyperlink is taking you to a website outside of Dell Technologies.

LibYAML

CVE-2014-9130

https://nvd.nist.gov/vuln/detail/CVE-2014-9130This hyperlink is taking you to a website outside of Dell Technologies.

mutt

CVE-2022-1328

https://nvd.nist.gov/vuln/detail/CVE-2022-1328This hyperlink is taking you to a website outside of Dell Technologies.

OpenSC

CVE-2018-16391

https://nvd.nist.gov/vuln/detail/CVE-2018-16391This hyperlink is taking you to a website outside of Dell Technologies.

libgcrypt

CVE-2018-0495

https://nvd.nist.gov/vuln/detail/CVE-2018-0495This hyperlink is taking you to a website outside of Dell Technologies.

pypi/setuptools

CVE-2022-40897

https://nvd.nist.gov/vuln/detail/CVE-2022-40897This hyperlink is taking you to a website outside of Dell Technologies.

RPM

CVE-2021-35939

https://nvd.nist.gov/vuln/detail/CVE-2021-35939This hyperlink is taking you to a website outside of Dell Technologies.

util-linux

CVE-2022-0563

https://nvd.nist.gov/vuln/detail/CVE-2022-0563This hyperlink is taking you to a website outside of Dell Technologies.

Apache James MIME4J

CVE-2022-45787

https://nvd.nist.gov/vuln/detail/CVE-2022-45787This hyperlink is taking you to a website outside of Dell Technologies.

Network Time Protocol project (NTP)

CVE-2023-26555

https://nvd.nist.gov/vuln/detail/CVE-2023-26555This hyperlink is taking you to a website outside of Dell Technologies.

Readline

CVE-2014-2524

https://nvd.nist.gov/vuln/detail/CVE-2014-2524This hyperlink is taking you to a website outside of Dell Technologies.

Proprietary Code CVEs

Description

CVSS Base Score

CVSS Vector String

CVE-2025-21117

Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI. A low privileged local attacker could potentially exploit this vulnerability, leading to fully impersonating the user.

6.6

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:NThis hyperlink is taking you to a website outside of Dell Technologies.

Proprietary Code CVEs

Description

CVSS Base Score

CVSS Vector String

CVE-2025-21117

Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI. A low privileged local attacker could potentially exploit this vulnerability, leading to fully impersonating the user.

6.6

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:NThis hyperlink is taking you to a website outside of Dell Technologies.
Dell Technologies는 모든 고객이 CVSS 기본 점수와 관련 임시 및 환경 점수를 모두 고려할 것을 권장합니다. 이 경우 특정 보안 취약성과 관련된 잠재적인 심각도에 영향을 미칠 수 있습니다.

영향을 받는 제품 및 문제 해결

Product

Software/Firmware

Affected Versions

Remediated Versions

Link

Dell Avamar Data Store Gen5A, Gen4T

Dell Avamar operating system

Versions 19.4, 19.7,19.8,19.9,19.10 and 19.10 SP1

Version 19.12 or later

https://dl.dell.com/downloads/TCM61_Avamar-19.12-for-Server-and-AVE-Upgrades.avp

Avamar Virtual Edition for VMware ESXi and vSphere

Dell Avamar operating system

Versions 19.4, 19.7,19.8,19.9,19.10 and 19.10 SP1

Version 19.12 or later

https://dl.dell.com/downloads/1GK63_Avamar-19.12-Virtual-Edition-for-VMware-ESXi-and-vSphere.7z

Avamar Virtual Edition for VMware vSphere only

Dell Avamar operating system

Versions 19.4, 19.7,19.8,19.9,19.10 and 19.10 SP1

Version 19.12 or later

https://dl.dell.com/downloads/KF9JJ_Avamar-19.12-Virtual-Edition-for-VMware-vSphere-only.ova

Avamar Virtual Edition for Hyper-V 2012

Dell Avamar operating system

Versions 19.4, 19.7,19.8,19.9,19.10 and 19.10 SP1

Version 19.12 or later

https://dl.dell.com/downloads/5X67J_Avamar-19.12-Virtual-Edition-for-Hyper-V-2012.7z

Avamar Virtual Edition for Hyper-V 2012R2, Hyper-V 2016, and Hyper-V 2019

Dell Avamar operating system

Versions 19.4, 19.7,19.8,19.9,19.10 and 19.10 SP1

Version 19.12 or later

https://dl.dell.com/downloads/PY5P3_Avamar-19.12-Virtual-Edition-for-Hyper-V-2012R2,-Hyper-V-2016,-and-Hyper-V-2019.7z

Avamar Virtual Edition for KVM/Open Stack KVM

Dell Avamar operating system

Versions 19.4, 19.7,19.8,19.9,19.10 and 19.10 SP1

Version 19.12 or later

https://dl.dell.com/downloads/0CJC4_Avamar-19.12-Virtual-Edition-for-KVM-OpenStack-KVM.7z

Product

Software/Firmware

Affected Versions

Remediated Versions

Link

Dell Avamar Data Store Gen5A, Gen4T

Dell Avamar operating system

Versions 19.4, 19.7,19.8,19.9,19.10 and 19.10 SP1

Version 19.12 or later

https://dl.dell.com/downloads/TCM61_Avamar-19.12-for-Server-and-AVE-Upgrades.avp

Avamar Virtual Edition for VMware ESXi and vSphere

Dell Avamar operating system

Versions 19.4, 19.7,19.8,19.9,19.10 and 19.10 SP1

Version 19.12 or later

https://dl.dell.com/downloads/1GK63_Avamar-19.12-Virtual-Edition-for-VMware-ESXi-and-vSphere.7z

Avamar Virtual Edition for VMware vSphere only

Dell Avamar operating system

Versions 19.4, 19.7,19.8,19.9,19.10 and 19.10 SP1

Version 19.12 or later

https://dl.dell.com/downloads/KF9JJ_Avamar-19.12-Virtual-Edition-for-VMware-vSphere-only.ova

Avamar Virtual Edition for Hyper-V 2012

Dell Avamar operating system

Versions 19.4, 19.7,19.8,19.9,19.10 and 19.10 SP1

Version 19.12 or later

https://dl.dell.com/downloads/5X67J_Avamar-19.12-Virtual-Edition-for-Hyper-V-2012.7z

Avamar Virtual Edition for Hyper-V 2012R2, Hyper-V 2016, and Hyper-V 2019

Dell Avamar operating system

Versions 19.4, 19.7,19.8,19.9,19.10 and 19.10 SP1

Version 19.12 or later

https://dl.dell.com/downloads/PY5P3_Avamar-19.12-Virtual-Edition-for-Hyper-V-2012R2,-Hyper-V-2016,-and-Hyper-V-2019.7z

Avamar Virtual Edition for KVM/Open Stack KVM

Dell Avamar operating system

Versions 19.4, 19.7,19.8,19.9,19.10 and 19.10 SP1

Version 19.12 or later

https://dl.dell.com/downloads/0CJC4_Avamar-19.12-Virtual-Edition-for-KVM-OpenStack-KVM.7z
  • The CVEs remedied by this security update are listed.  The list not only have the new CVEs remedied by this update, but all the past CVEs included in this cumulative update. Due to dependencies on the above fixes, it cannot be backported.
  • The OS Rollup 2024 R3 CVE is included in the 19.12 release. For further information on the OS Rollup 2024 R3 see. DSA-2024-433
  • Dell recommends that you always upgrade to the latest release/version for your product.
  • To schedule platform security patch installation, or to upgrade your server, contact Dell Customer Support at https://www.dell.com/support/home/product-support/product/avamar/drivers
  • CVE-2014-9515 corresponding to Dozer Third Party Component is also remediated as a part of Version 19.10 SP1 corresponding to DSA-2024-280

개정 내역

Revision

Date

Description

1.0

2025-02-05

Initial Release

관련 정보

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

법적 고지 사항

해당 제품

Avamar, Avamar Client, Avamar Client for VMware, Avamar Client for Windows, Avamar Data Store, Avamar Data Store Gen4T, Avamar Data Store Gen5A, Avamar Desktop/Laptop Option, Avamar Plug-in for Hyper-V VSS, Avamar Plug-in for NDMP, Avamar Server , Avamar Virtual Edition ...
문서 속성
문서 번호: 000281275
문서 유형: Dell Security Advisory
마지막 수정 시간: 09 9월 2025
다른 Dell 사용자에게 질문에 대한 답변 찾기
지원 서비스
디바이스에 지원 서비스가 적용되는지 확인하십시오.