Security Bulletin: Vulnerabilities in IBM Java SDK affect IBM InfoSphere Global Name Management (CVE-2020-27221)

2022-04-2017:04:55

www.ibm.com

ibm infosphere global name management

ibm java sdk

eclipse openj9

vulnerabilities

buffer overflow

remote code execution

upgrade

version 6

version 7

security bulletin

EPSS

0.004

Percentile

74.6%

JSON

Summary

Eclipse OpenJ9 (used as part of IBM InfoSphere Global Name Management) when running on Linux or AIX is vulnerable to a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding. By sending an overly long string, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s)	Version(s)
IBM InfoSphere Global Name Management	6.0

Remediation/Fixes

Customers with IBM InfoSphere Global Name Management version 6 are encouraged to upgrade to version 7, which includes a fix for this issue.

For customers remaining on IBM InfoSphere Global Name Management version 6: Per original bulletin at <https://www.ibm.com/support/pages/node/6414721>, apply IBM SDK Java Technology Edition, version 8.0.6.25 or later as available from IBM Fix Central. IBM recommends installing the latest Version 8 Service Refresh 6 release.