Security Bulletin: Unspecified Vulnerabilities in Rational Synergy (CVE-2012-0502,CVE-2012-0503,CVE-2012-0506,CVE-2012-0507,CVE-2011-3563,CVE-2012-0500,CVE-2012-0497,CVE-2012-0498,CVE-2012-0499,CVE-2012-0500,CVE-2012-0501,CVE-2012-0505,CVE-2011-5035)

Summary

Vulnerabilities in the Java Runtime Environment (JRE) 6 update 32 and earlier component shipped with IBM Rational Synergy may affect the security of the product.

Vulnerability Details

| Subscribe to My Notifications to be notified of important product support alerts like this.

• Follow this link for more information (requires login with your IBM ID)
  —|—

CVE ID:CVE-2012-0502

**Description:**Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality and availability, related to AWT.

CVSS Base Score: 6.4 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/73193&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVE ID:CVE-2012-0503

**DESCRIPTION:**Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability, related to I18n.

CVSS Base Score: 7.5 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/73191&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVE ID:CVE-2012-0506

**DESCRIPTION:**Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to CORBA.

CVSS Base Score: 4.3 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/73196&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVE ID:CVE-2012-0507

**DESCRIPTION:**Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency.

CVSS Base Score: 10 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/72513&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVE ID:CVE-2011-3563

**DESCRIPTION:**Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote attackers to affect confidentiality and availability via unknown vectors related to Sound.

CVSS Base Score: 6.4 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/73194&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVE ID:CVE-2012-0500

**DESCRIPTION:**Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS Base Score: 10 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/73188&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVE ID:CVE-2012-0497

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D**.**

CVSS Base Score: 10 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/73185&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVE ID:CVE-2012-0498

**DESCRIPTION:**Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS Base Score: 10 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/73186&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

**CVE ID:**CVE-2012-0499

**DESCRIPTION:**Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS Base Score: 10 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/73187&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVE ID:CVE-2012-0501

**DESCRIPTION:**Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote attackers to affect availability via unknown vectors.

CVSS Base Score: 5 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/73195&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVE ID:CVE-2012-0505** **

DESCRIPTION: Unspecified vulnerability in the Java Runtime Environment (JRE) component in JRE 6 Update 30 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Serialization.

CVSS Base Score: 7.5 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/73192&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVE ID:CVE-2011-5035** **

**DESCRIPTION:**Rational Synergy computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.

CVSS Base Score: 5 **CVSS Temporal Score:**See <https://exchange.xforce.ibmcloud.com/vulnerabilities/72015&gt; for the current score *CVSS Environmental Score:**Undefined CVSS Vector: (AV:N/AC:M/Au:S/C:N/I:P/A:N)

Affected Products and Versions

Rational Synergy 7.2, 7.2.0.1, 7.2.0.2

Rational Synergy 7.1, 7.1.0.1, 7.1.0.2, 7.1.0.3, 7.1.0.4, 7.1.0.5

Remediation/Fixes

Rational Synergy 7.2: upgrade to Rational Synergy 7.2.0.3
Rational Synergy 7.1: upgrade to Rational Synergy 7.1.0.6

Workarounds and Mitigations

None