Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM DB2 QMF for Workstation (CVE-2015-2613, CVE-2015-2601, CVE-2015-2625)

Summary

There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 6 and 8 that are used by IBM DB2 QMF for Workstation. These issues were disclosed as part of the IBM Java SDK updates in July 2015.

Vulnerability Details

CVEID: CVE-2015-2613 DESCRIPTION: An unspecified vulnerability and Java SE Embedded related to the JCE component could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/104734 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID: CVE-2015-2601 DESCRIPTION: An unspecified vulnerability related to the JCE component could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/104733 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID: CVE-2015-2625 DESCRIPTION: An unspecified vulnerability related to the JSSE component could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 2.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/104743 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:P/I:N/A:N)

Affected Products and Versions

• DB2 QMF for z/OS Version 11 Release 1, Fix Pack 4 (and lower)
• DB2 QMF Enterprise Edition Version 11 Release 1, Fix Pack 4 (and lower)
• DB2 QMF Enterprise Edition Version 10 Release 1, Fix Pack 11 (and lower)

Remediation/Fixes

Product

| VR|Remediation/First Fix
—|—|—
DB2 QMF for Workstation for z/OS| _11.1 _| Java JRE 8.0 SR1 FP10 from IBM Fix Central
DB2 QMF for Workstation Enterprise Edition| 11.1| Java JRE 8.0 SR1 FP10 from IBM Fix Central
DB2 QMF for Workstation Enterprise Edition| 10.1| Java JRE 6.0 SR16 FP7 from IBM Fix Central

Workarounds and Mitigations

None