7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
IBM MQ Internet Pass-Thru has addressed the following vulnerabilities in IBM Runtime Environment Java Version 7.0.10.50. These issues were disclosed as part of the IBM Java SDK updates in July 2019.
CVEID:CVE-2019-4473
**DESCRIPTION:**Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984.
CVSS Base score: 8.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/163984 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID:CVE-2019-11771
**DESCRIPTION:**AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users.
CVSS Base score: 8.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/163989 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Product(s) | Version(s) |
---|---|
IBM WebSphere Internet Pass-Thru | 2.1 |
These vulnerabilities are fixed in IBM Java Version 7.0 Service Refresh 10 Fix Pack 50 for AIX. A JRE update to this level of Java for MQIPT 2.1.0.4 is available to download from the MS81: IBM MQ Internet Pass-Thru SupportPac page, via the Download package link. The JRE update files are named ms81_jre__platform__70sr10fp50, where platform is the operating system and architecture where MQIPT is running.
These vulnerabilities are fixed in IBM Java Version 7.0 Service Refresh 10 Fix Pack 50 for AIX.
A JRE update to this level of Java for MQIPT 2.1.0.4 is available to download from the MS81: IBM MQ Internet Pass-Thru SupportPac page, via the Download package link.
The JRE update file is named ms81_jre_aix_ppc_70sr10fp50.
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P