Security Bulletin: Vulnerability in IBM Java Runtime affects TPF Toolkit (CVE-2016-3485)

Summary

There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 7 that is used by TPF Toolkit.

Vulnerability Details

CVEID:CVE-2016-3485**
DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the Networking component has no confidentiality impact, low integrity impact, and no availability impact. **
CVSS Base Score: 2.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/115273 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

TPF Toolkit 4.0.x, and 4.2.x

Remediation/Fixes

Product

| VRMF|APAR|Remediation/First Fix
—|—|—|—
TPF Toolkit| 4.2.x| JR56503|

1. Install the latest version of IBM Installation Manager.

2. Apply Interim Fix 4.2.8 by using IBM Installation Manager.

3. Update the Java installation on your z/OS or Linux on z Systems (or both) systems that the TPF Toolkit connects to. Download the latest version of Java from http://www.ibm.com/developerworks/java/jdk/
   TPF Toolkit| 4.0.x| JR56502|

4. Install the latest version of IBM Installation Manager.

5. Apply Interim Fix 4.0.11 by using IBM Installation Manager.

6. Update the Java installation on your z/OS or Linux on z Systems (or both) systems that the TPF Toolkit connects to. Download the latest version of Java from http://www.ibm.com/developerworks/java/jdk/

Workarounds and Mitigations

None