Security Bulletin: Multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 6 and 7 affect IBM Content Collector for SAP Applications (CVE-2015-2613, CVE-2015-2601, CVE-2015-2625, CVE-2015-1931)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 6 and 7 that is used by IBM Content Collector for SAP Applications. These issues were disclosed as part of the IBM Java SDK updates in July 2015. Vulnerability Details CVEID: CVE-2015-2613...

Security Bulletin: Three security vulnerabilities have been identified in WebSphere Application Server shipped with IBM eDiscovery Manager (CVE-2015-1885, CVE-2015-1927, CVE-2015-1946)

Summary WebSphere Application Server is shipped as a component of IBM eDiscovery Manager. Information about three security vulnerabilities that affect WebSphere Application Server are published in a security bulletin. Vulnerability Details For more information, see the WebSphere Application Serve...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Content Collector for SAP Applications (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM Content Collector for SAP Applications Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects FileNet Content Manager, IBM Content Foundation and FileNet Business Process Manager. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM eDiscovery Analyzer (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM eDiscovery Analyzer. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly...

Security Bulletin: Vulnerabilities in IBM Java SDK affect IBM eDiscovery Analyzer

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM eDiscovery Analyzer. These issues were disclosed as part of the IBM Java SDK updates in April 2015. Vulnerability Details CVEID:CVE-2015-0488 DESCRIPTION: An unspecified vulnerability related to th...

Security Bulletin: Two vulnerabilities exist in IBM FileNet Content Manager and IBM Content Foundation (CVE-2015-0474 and CVE-2015-0493)

Summary Oracle Outside In Technology vulnerabilities were disclosed on April 14, 2015 by Oracle. These vulnerabilities are documented in CVE-2015-0474 and CVE-2015-0493 and affect the IBM FileNet Content Manager and IBM Content Foundation products. Vulnerability Details CVEID: CVE-2015-0474...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-0488, CVE-2015-0478, CVE-2015-1916)

Summary There are multiple vulnerabilities in the IBM Runtime Environment Java Technology Edition used by FileNet Content Manager, IBM Content Foundation and FileNet Business Process Manager. These issues are addressed in Version 1.6.0 SR16 FP4 which is part of the IBM Java SDK April 2015 update...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Content Collector for SAP Applications (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM Content Collector for SAP Applications. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION:The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Content Collector and IBM CommonStore for Lotus Domino (CVE-2015-0138, CVE-2014-6593, CVE-2015-0383, CVE-2015-0410)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6, that is used by IBM Content Collector and IBM CommonStore for Lotus Domino. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses the...

Security Bulletin: Vulnerability in IBM Java Runtime affects IBM FileNet Content Manager and IBM Content Foundation (CVE-2015-0138)

Summary The Factoring Attack on RSA-EXPORT keys "FREAK", TLS/SSL client and server security vulnerability affects IBM® SDK Java™ Technology Edition, Version 1.6.0 SR16 FP3 and earlier. TLS/SSL is a configurable option in IBM FileNet Content Manager and IBM FileNet BPM products to provide secure...

Security Bulletin: Vulnerabilities in IBM Java SDK affects IBM eDiscovery Analyzer

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM eDiscovery Analyzer. These issues were disclosed as part of the IBM Java SDK updates in January 2015. Vulnerability Details CVEID: CVE-2014-6593 DESCRIPTION: An unspecified vulnerability related to...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Content Collector for SAP Applications (CVE-2014-6593, CVE-2015-0410, CVE-2015-0383, CVE-2015-0138)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 and 7 that is used by IBM Content Collector for SAP Applications. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses the “FREAK:...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Rational RequisitePro (CVE-2015-3194, CVE-2015-3196, CVE-2016-0702)

Summary OpenSSL vulnerabilities were disclosed on December 3, 2015 and March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM Rational RequisitePro. IBM Rational RequisitePro has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-3194 DESCRIPTION: OpenSSL is vulnerable to ...

Security Bulletin: Rational Systems Tester is affected by Libxml2 vulnerability (CVE-2015-8710)

Summary Denial-Of-service vulnerability has been discovered in Libxml2 that was reported on Dec 31, 2015 Vulnerability Details CVE-ID: CVE-2015-8710 Description: Libxml2 is vulnerable to a denial of service, caused by an out-of-bounds memory access when parsing an unclosed HTML comment. By using...

Security Bulletin: node-uuid unsafe fallback to Math.random (CVE-2015-8851)

Summary A vulnerability in the node-uuid module causes the module to fallback on math.random under certain circumstances, which leads to predictable UUIDs. The node-uuid module is used by the Node.js Package Manager npm. Vulnerability Details CVEID: CVE-2015-8851 DESCRIPTION: node.js node-uuid...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Service Tester (CVE-2015-7575, CVE-2016-0475)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 & 8 that is used by Rational Service Tester. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and includes the vulnerability commonly referred to as “SLOTH”. Vulnerability...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Performance Tester (CVE-2015-7575, CVE-2016-0475)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 & 8 that is used by Rational Performance Tester. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and includes the vulnerability commonly referred to as “SLOTH”. Vulnerability...

Security bulletin: Rational Directory Server (Tivoli) is affected by an Apache Tomcat vulnerability (CVE-2015-5174)

Summary The Apache Tomcat application server in installations of IBM Rational Directory Server Tivoli contains a security vulnerability CVE-2015-5174. Vulnerability Details A version of Rational Directory Server Tivoli is shipped with an Apache Tomcat application server that contains a security...

Security Bulletin: A vulnerbility in Bouncy Castle affects Rational Service Tester (CVE-2015-7940 )

Summary Bouncy Castle could allow a remote attacker to obtain sensitive information, caused by an invalid curve attack. An attacker could exploit this vulnerability to extract private keys used in elliptic curve crytpography and obtain sensitive information. Vulnerability Details CVEID:...