Security Bulletin: Multiple vulnerabilities in IBM Java SDK (or if just using Runtime state IBM Java Runtime) affect IBM Network Advisor (CVE-2015-4748, CVE-2016-2613, CVE-2016-2601, CVE-2016-4749, CVE-2016-2625)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM Network Advisor. These issues were disclosed as part of the IBM Java SDK updates in July 2015. Vulnerability Details CVEID: CVE-2015-4748 DESCRIPTION: An unspecified vulnerability related to the...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Network Advisor.

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM b-type SAN Network Advisor. These issues were disclosed as part of the IBM Java SDK updates for October 2015 CVE-2015-4872, CVE-2015-4911, CVE-2015-4893, CVE-2015-4803. Vulnerability Details CVEID:...

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM FlashSystem model V840 (CVE-2015-7575)

Summary The MD5 “SLOTH” vulnerability on TLS 1.2 affects IBM® FlashSystem™ V840. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message...

Security Bulletin: IBM Virtualization Engine TS7700 Is Affected by IBM GPFS Security Vulnerability (CVE-2015-1788)

Summary An OpenSSL denial of service vulnerability disclosed by the OpenSSL Project affects GSKit, which is used by the version of IBM GPFS used by the TS7700. Vulnerability Details CVEID: CVE-2015-1788 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an error when processing ...

Security Bulletin: IBM Virtualization Engine TS7700 Is Affected by IBM GPFS Security Vulnerabilities (CVE-2015-4974 CVE-2015-4981)

Summary Security vulnerabilities have been identified in the current levels of IBM GPFS as used by the TS7700: - could allow a local non privileged attacker to execute commands with root privileges CVE-2015-4974 - could allow a local non privileged attacker to read system memory contents...

Security Bulletin: : A cross-site request forgery vulnerability affects the IBM FlashSystem model V840 (CVE-2015-7446)

Summary There is a cross-site request forgery vulnerability to which the IBM® FlashSystem™ V840 is susceptible. An exploit of this vulnerability could allow cross-site scripting attacks, Web cache poisoning, and other malicious activities. Vulnerability Details CVEID: CVE-2015-7446 DESCRIPTION: I...

Security Bulletin: A cross-site request forgery vulnerability affects the IBM FlashSystem model V9000 (CVE-2015-7446)

Summary There is a cross-site request forgery vulnerability to which the IBM® FlashSystem™ V9000 is susceptible. An exploit of this vulnerability could allow cross-site scripting attacks, Web cache poisoning, and other malicious activities. Vulnerability Details CVEID: CVE-2015-7446 DESCRIPTION:...

Security Bulletin: A vulnerability in the Linux Pluggable Authentication Module (PAM) affects the IBM FlashSystem model V9000 (CVE-2015-3238)

Summary There is a vulnerability in Linux Pluggable Authentication Module PAM to which the IBM® FlashSystem™ V9000 is susceptible. An exploit of this vulnerability could allow a remote attacker to expose sensitive information and/or cause a denial of service. Vulnerability Details CVEID:...

Security Bulletin: A vulnerability in the Linux Pluggable Authentication Module (PAM) affects the IBM FlashSystem model V840 (CVE-2015-3238)

Summary There is a vulnerability in the Linux Pluggable Authentication Module PAM to which the IBM® FlashSystem™ V840 is susceptible. An exploit of this vulnerability could allow a remote attacker to expose sensitive information and/or cause a denial of service. Vulnerability Details CVEID:...

Security Bulletin: A vulnerability in Network Security Services (NSS) affects the IBM FlashSystem model V840 (CVE-2015-2730)

Summary There is a vulnerability in Network Security Services NSS to which the IBM® FlashSystem™ V840 is susceptible. An exploit of this vulnerability could allow a remote attacker could exploit this vulnerability to forge signatures. Vulnerability Details CVEID: CVE-2015-2730 DESCRIPTION: Mozill...

Security Bulletin: A vulnerability in Network Security Services (NSS) affects the IBM FlashSystem model V9000 (CVE-2015-2730)

Summary There is a vulnerability in Network Security Services NSS to which the IBM® FlashSystem™ V9000 is susceptible. An exploit of this vulnerability could allow a remote attacker to gain unauthorized access to forge signatures. Vulnerability Details CVEID: CVE-2015-2730 DESCRIPTION: Mozilla...

Security Bulletin: A vulnerability in Struts affects the IBM FlashSystem model V9000 (CVE-2015-5209)

Summary There is a vulnerability in Apache Struts to which the IBM® FlashSystem™ V9000 is susceptible. An exploit of this vulnerability could allow a remote attacker to gain unauthorized access to the system. Vulnerability Details CVEID: CVE-2015-5209 DESCRIPTION: Apache Struts could allow a remo...

Security Bulletin: Vulnerability in Apache Commons affects IBM Virtualization Engine TS7700 (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by IBM Virtualization Engine TS7700. Vulnerability Details CVEID: CVE-2015-7450 DESCRIPTION: Apache Commons Collections could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: GPFS security vulnerabilities in IBM Storwize V7000 Unified (CVE-2015-4974 and CVE-2015-4981)

Summary A fix is available for IBM Storwize V7000 Unified, for GPFS security vulnerabilities Vulnerability Details IBM General Parallel File System GPFS is a high-performance clustered file system. It is used in IBM Storwize V7000 Unified. CVEID: CVE-2015-4974 DESCRIPTION: IBM General Parallel Fi...

Security Bulletin: A vulnerability in Open Source Struts affects the IBM FlashSystem V9000 (CVE 2015-1831)

Summary There is a vulnerability in the Open Source Struts used by the IBM FlashSystem V9000. An exploit of this vulnerability could result in an attacker gaining control of internal states which affect the FlashSystem V9000. Vulnerability Details CVEID: CVE-2015-1831 DESCRIPTION: An unspecified...

Security Bulletin: Vulnerabilities in Open Source OpenSSL affects the IBM FlashSystem V840 (CVE-2015-1788, CVE-2015-1789, CVE-2015-1791, and CVE-2015-3216)

Summary There are vulnerabilities in the Open Source OpenSSL version that is used by the IBM® FlashSystem™ V840. An exploit of these vulnerabilities could result in a denial of service. One vulnerability can result in a race condition, the result of which is of unknown impact. Vulnerability Detai...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Network Advisor (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM Network Advisor. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM SONAS (CVE-2015-2613)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 6 that is used by IBM SONAS. This issue was disclosed as part of the IBM Java SDK updates in July 2015. Vulnerability Details CVEID: CVE-2015-2613 DESCRIPTION: An unspecified vulnerability in Oracle Jav...

Security Bulletin: libuser vulnerabilities affect IBM Storwize V7000 Unified (CVE-2015-3245 and CVE-2015-3246)

Summary Fixes for security vulnerabilities in libuser are available with IBM Storwize V7000 Unified version 1.5.2.2 Vulnerability Details CVEID: CVE-2015-3245 DESCRIPTION: libuser is vulnerable to a denial of service, caused by the failure to properly filter out newline characters by the chfn...

Security Bulletin: libuser vulnerabilities affect IBM SONAS (CVE-2015-3245 and CVE-2015-3246)

Summary Fixes for security vulnerabilities in libuser are available with IBM SONAS version 1.5.2.2 Vulnerability Details CVEID: CVE-2015-3245 DESCRIPTION: libuser is vulnerable to a denial of service, caused by the failure to properly filter out newline characters by the chfn function within the...