Security Bulletin: OpenSource Spring Source/Pivotal Spring Framework Vulnerabilities affect IBM Security Guardium (CVE-2013-7315, CVE-2013-4152, CVE-2014-0054)

Summary Pivotal Spring Framework could allow a remote attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2013-7315 DESCRIPTION: Pivotal Spring Framework could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection XXE error when...

Security Bulletin: IBM Security Proventia Network Active Bypass is affected by vulnerabilities in OpenSSH (CVE-2013-4548)

Summary Security vulnerabilities have been discovered in OpenSSH. Vulnerability Details CVE-ID: CVE-2013-4548 DESCRIPTION: A memory corruption vulnerability exists in the post-authentication sshd process when an AES-GCM cipher [email protected] or [email protected] is selected during ke...

Security Bulletin: Using Components with Known Vulnerabilities affects IBM Security Guardium (multiple CVEs)

Summary IBM Security Guardium is vulnerable to several possible remote attacks Vulnerability Details CVEID: CVE-2015-4881 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the CORBA component has complete confidentiality impact, complete integrity impact, and complete...

Security Bulletin: A vulnerability in GNU glibc affects IBM Security Network Protection (CVE-2013-7424)

Summary The GNU glibc packages provide the standard C libraries libc, POSIX thread libraries libpthread, standard math libraries libm, and the Name Server Caching Daemon nscd used by multiple programs on the system. Security vulnerabilities have been discovered in glibc used with IBM Security...

Security Bulletin: Multiple vulnerabilities affect IBM Security SiteProtector Appliance (CVE-2013-2566, CVE-2014-6321, CVE-2015-0162)

Summary There are multiple vulnerabilities identified in IBM Security SiteProtector Appliance. Vulnerability Details CVEID: CVE-2013-2566 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information, caused by the...

Security Bulletin: SiteProtector System can be affected by several vulnerabilities in the IBM Java Runtime Environment (CVE-2013-6954, CVE-2013-6629, CVE-2014-2421, CVE-2014-0453, CVE-2014-1876, CVE-2014-4244, CVE-2014-4263) and in Tomcat (CVE-2014-0075)

Summary The IBM Security SiteProtector System product can be impacted by several vulnerabilities in the IBM SDK Java Technology Edition Version 6 and 7 as well as a vulnerability in Tomcat. Vulnerability Details Java Runtime Environment Vulnerability Details: CVE ID: CVE-2013-6954 DESCRIPTION: A...

Security Bulletin: IBM Security Network Protection System can be affected by vulnerabilities in Ruby on Rails and the Ruby language (CVE-2013-4492, CVE-2013-4164)

Summary IBM Security Network Protection System can be affected by vulnerabilities in Ruby on Rails and the Ruby language. These vulnerabilities include obtaining sensitive information, executing arbitrary code on the system or causing the application to crash. Vulnerability Details VULNERABILITY...

Security Bulletin: IBM GSKit Certificate Chain Vulnerability in Tivoli Access Manager and IBM Security Access Manager for Web (CVE-2013-6747)

Summary A specially constructed certificate could cause Tivoli Access Manager and IBM Security Access Manager for Web to stop responding or crash. Vulnerability Details CVEID: CVE-2013-6747 DESCRIPTION: Tivoli Access Manager and IBM Security Access Manager for Web use digital certificates to veri...

Security Bulletin: GSKit SSL negotiation vulnerability in Tivoli Access Manager for e-business (CVE-2013-6329)

Summary A vulnerability has been identified in the GSKit component utilized by Tivoli Access Manager for e-business TAM. A specially crafted SSL message can cause the TAM server component using GSKit to crash. Remediation for the issue consists of upgrading affected GSKit following the instructio...

Security Bulletin: Security Network Protection is affected by a cross-site scripting vulnerability (CVE-2013-5442)

Summary IBM Security Network Protection is affected by a cross-site scripting vulnerability that could be used to impersonate a legitimate user, allowing the impersonator to alter user records, and to perform transactions as that user. Vulnerability Details The IBM Security Network Protection Loc...

Security Bulletin: IBM Tivoli Access Manager - token authentication RSA SecurID library uses weak cryptography (CVE-2013-0941)

Summary This bulletin applies to the WebSEAL component of Tivoli Access Manager for e-business TAM systems participating in token authentication. Earlier versions of the Authentication API provided by RSA used poor cryptography in generating keys which are used to encrypt communications between t...

Security Bulletin: Multiple vulnerabilities in PHP and memcached libraries affect IBM Tealeaf Customer Experience

Summary The IBM Tealeaf Customer Experience PCA component uses versions of PHP and memcached with reported security issues. Vulnerability Details CVEID: CVE-2013-0179 DESCRIPTION: memcached is vulnerable to a denial of service, caused by an error in the processbindelete function within memcached....

Security Bulletin: IBM Forms Viewer can crash on some embedded PNG images (CVE-2013-6954)

Summary A XFDL form with a PNG image that exposes this issue can crash the IBM Forms Viewer Vulnerability Details CVEID: CVE-2013-6954 DESCRIPTION: A XFDL form can be created utilizing a specially created PNG image that could result in the IBM Forms Viewer to crash. CVSS Base Score: 4.3 CVSS...

Security Bulletin: Security vulnerabilities in ActiveMQ 5.2.0 affect IBM Sterling B2B Integrator (CVE-2015-1830, CVE-2014-8110, CVE-2013-3060, CVE-2013-1880, CVE-2013-1879, CVE-2012-6551, CVE-2012-6092, CVE-2010-1587, CVE-2010-1244, CVE-2010-0684)

Summary Multiple directory traversal, cross-site scripting, denial of service and cross-site request forgery security vulnerabilities in ActiveMQ 5.2.0. IBM Sterling B2B Integrator has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-1830 DESCRIPTION: Apache ActiveMQ could all...

Security Bulletin:Sterling Web Channel is affected by Apache Struts 2 security vulnerabilities (CVE-2013-4310, CVE-2013-4316, CVE-2013-2251, CVE-2013-2248, CVE-2013-2135, CVE-2013-2134, CVE-2013-2115, CVE-2013-1966, CVE-2013-1965)

Summary IBM Sterling Web Channel use Apache Struts 2 and is affected by some of the vulnerabilities that exist in Apache Struts 2. Vulnerability Details CVEID: CVE-2013-4310 Description: Apache Struts could allow a remote attacker to bypass security restrictions, caused by an error in the action:...

Security Bulletin: IBM Tealeaf CX Passive Capture Application is vulnerable to a remotely exploitable OS command injection and local file inclusion (CVE-2013-6719 and CVE-2013-6720)

Summary IBM Tealeaf CX Passive Capture Application is vulnerable to a remotely exploitable OS command injection and local file inclusion. These vulnerabilities may be exploited to compromise the host system. Vulnerability Details Two areas of vulnerability are found in the IBM Tealeaf CX Passive...

Security Bulletin: Multiple security vulnerabilities exist in WebSphere Transformation Extender (CVE-2013-5802 CVE-2013-4002 CVE-2013-5825 CVE-2013-5372 CVE-2013-0599 CVE-2013-0464 CVE-2013-0467 CVE-2013-2962 CVE-2013-2415)

Summary WebSphere Transformation Extender products are affected by multiple security vulnerabilities that exist in Oracle JRE and IBM Eclipse Help System. Additionally, WTX Launcher is vulnerable to a denial of service attack using a buffer overflow. Vulnerability Details WebSphere Transformation...

Security Bulletin: Potential Security Vulnerabilities in Oracle Java 6 SDK affecting IBM WebSphere Multichannel Bank Transformation Toolkit version 8

Summary IBM WebSphere Multichannel Bank Transformation Toolkit version 8.x has a potential security exposure due to vulnerabilities in the Oracle Java 6 SDK that allow remote attackers to affect confidentiality, integrity and availability of the Java platform via various vectors. It happens only ...

Security Bulletin: Potential SSL/TLS-related denial of service vulnerability in IBM Informix Server (CVE-2013-6329)

Summary Informix Server is impacted by a vulnerability in IBM's GSKIT library which can result in a denial of service caused by an error in SSL/TLS handshake processing related to session resumption when using SSLv2. A remote attacker could exploit this vulnerability to cause the system to crash...

Security Bulletin: Potential SSL/TLS-related denial of service vulnerability in IBM Informix Client SDK (CVE-2013-6329)

Summary Informix Client SDK is impacted by a vulnerability in IBM's GSKIT library which can result in a denial of service caused by an error in SSL/TLS handshake processing related to session resumption when using SSLv2. A remote attacker could exploit this vulnerability to cause the system to...