Security Bulletin: Multiple security vulnerabilities affect IBM WebSphere Application Server bundled with IBM WebSphere Application Server Patterns and IBM WebSphere Application Server on Cloud

Summary

There is a potential cross-site scripting vulnerability in the Admin Console for WebSphere Application Server. There is a potential information disclosure in WebSphere Application Server using malformed SOAP requests on WebSphere Application Server.

Vulnerability Details

Please consult the security bulletins for vulnerability details and information about fixes:

• Security Bulletin: Potential cross-site scripting in the Admin Console for WebSphere Application Server (CVE-2016-8934)
• Security Bulletin: Potential Information Disclosure in WebSphere Application Server (CVE-2016-9736)

Affected Products and Versions

These vulnerabilities affect the following versions and releases of IBM WebSphere Application Server that IBM WebSphere Application Server Patterns supports:

* Version 8.0 traditional
* Version 8.5.5 traditional 
* Version 9.0 traditional

Remediation/Fixes

To patch an existing PureApplication Virtual System Instance, apply the patch using the PureApplication Maintainence fix process.