Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum LSF Analytics

Summary There are multiple vulnerabilities in IBM®Runtime Environment Java™Version 7 used by IBM Spectrum LSF Analytics. These issues were disclosed as part of the IBM Java SDK updates in January 2019. Vulnerability Details CVEID: CVE-2018-11212 DESCRIPTION: libjpeg is vulnerable to a denial of...

The vulnerability of the OpenJ9 JIT compiler component of the Eclipse OpenJ9 virtual machine, which allows a hacker to execute arbitrary code.

The vulnerability of the OpenJ9 JIT compiler in the Eclipse OpenJ9 virtual machine is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Security Bulletin: Multiple security vulnerabilities have been identified in Jazz Team Server shipped with Jazz Reporting Service (CVE-2018-1890, CVE-2018-12547, CVE-2019-2426, CVE-2018-11212)

Summary Jazz Team Server is shipped as a component of Jazz Reporting Service JRS. Information about multiple security vulnerabilities affecting Jazz Team Server and Jazz-based products has been published in a security bulletin. Vulnerability Details CVEID: CVE-2018-1890 DESCRIPTION: IBM SDK, Java...

JDK: buffer overflow in jio_snprintf() and jio_vsnprintf()

In Eclipse OpenJ9, prior to the 0.12.0 release, the jiosnprintf and jiovsnprintf native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code...

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition

Summary Java SE issues disclosed in the Oracle January 2019 Critical Patch Update, plus three additional vulnerabilities Vulnerability Details CVE IDs: CVE-2018-11212 CVE-2019-2426 CVE-2019-2449 CVE-2019-2422 CVE-2018-12547 CVE-2018-12549 CVE-2018-1890 DESCRIPTION: This bulletin covers all...

Memory corruption

In Eclipse Wakaama formerly liblwm2m 1.0, core/er-coap-13/er-coap-13.c in lwm2mserver in the LWM2M server mishandles invalid options, leading to a memory leak. Processing of a single crafted packet leads to leaking wasting 24 bytes of memory. This can lead to termination of the LWM2M server after...

CVE-2019-9004

In Eclipse Wakaama formerly liblwm2m 1.0, core/er-coap-13/er-coap-13.c in lwm2mserver in the LWM2M server mishandles invalid options, leading to a memory leak. Processing of a single crafted packet leads to leaking wasting 24 bytes of memory. This can lead to termination of the LWM2M server after...

CVE-2019-9004

In Eclipse Wakaama formerly liblwm2m 1.0, core/er-coap-13/er-coap-13.c in lwm2mserver in the LWM2M server mishandles invalid options, leading to a memory leak. Processing of a single crafted packet leads to leaking wasting 24 bytes of memory. This can lead to termination of the LWM2M server after...

CVE-2019-9004

In Eclipse Wakaama (formerly liblwm2m) 1.0, the LWM2M server’s core/er-coap-13/er-coap-13.c in lwm2mserver mishandles invalid options, causing a memory leak. Processing a single crafted packet can leak 24 bytes of memory, potentially exhausting available memory and causing the LWM2M server to ter...

CVE-2019-9004

In Eclipse Wakaama formerly liblwm2m 1.0, core/er-coap-13/er-coap-13.c in lwm2mserver in the LWM2M server mishandles invalid options, leading to a memory leak. Processing of a single crafted packet leads to leaking wasting 24 bytes of memory. This can lead to termination of the LWM2M server after...

Unsafe Dependency Resolution

Overview com.diffplug.gradle.spotless:spotless-eclipse-cdt is a code formatting library. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure connection, a malicious use...

Unsafe Dependency Resolution

Overview com.diffplug.spotless:spotless-eclipse-wtp is a code formatting library. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure connection, a malicious user could...

Unsafe Dependency Resolution

Overview com.diffplug.gradle.spotless:spotless-eclipse-groovy is a code formatting library. Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to resolving dependencies over an insecure channel http. If the build occurred over an insecure connection, a malicious...

[SECURITY] Fedora 29 Update: eclipse-linuxtools-7.1.0-3.fc29

The Linux Tools project is a two-faceted project. Firstly, it develops tools and frameworks for writing tools for Linux developers. Secondly, it provides a place for Linux distributions to collaboratively overcome issues surround ing distribution packaging of Eclipse technology. The project will...

[SECURITY] Fedora 29 Update: eclipse-jgit-5.2.0-4.fc29

A pure Java implementation of the Git version control system...

Fedora 29 : bouncycastle / eclipse-jgit / eclipse-linuxtools / etc (2019-df57551f6d)

Fixes CVE-2018-14718 CVE-2018-14719 CVE-2018-19360 CVE-2018-19361 CVE-2018-19362 CVE-2018-12022 CVE-2018-12023 CVE-2018-14720 CVE-2018-14721 and CVE-2016-7051. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable...

Eclipse OpenJ9 Buffer Overflow Vulnerability (CNVD-2019-39191)

Eclipse OpenJ9 is a Java application engine from the Eclipse Foundation. The product is primarily used to run Java applications. A security vulnerability exists in the OpenJDK + Eclipse OpenJ9 0.11.0 builds. An attacker can exploit the vulnerability to accept pointer values that are dereferenced ...

Eclipse OpenJ9 Buffer Overflow Vulnerability

Eclipse OpenJ9 is a Java application engine from the Eclipse Foundation. The product is primarily used to run Java applications. A buffer overflow vulnerability exists in Eclipse OpenJ9 versions prior to 0.12.0, which originates when a networked system or product performs an operation in memory...

Eclipse OpenJ9 Input Validation Error Vulnerability

clipse OpenJ9 is a Java application engine from the Eclipse Foundation. The product is primarily used to run Java applications. An input validation error vulnerability exists in Eclipse OpenJ9 version 0.11.0, which arises from a networked system or product that does not properly validate input...

Security Bulletin: Publicly Disclosed Vulnerability Found By vFinder (CVE-2017-7656, CVE-2017-7657, CVE-2017-7658, CVE-2018-12536)

Summary Previous releases of IBM UrbanCode Deploy are affected by multiple vulnerabilities in Eclipse Jetty Vulnerability Details CVEID: CVE-2017-7658 DESCRIPTION: Eclipse Jetty is vulnerable to HTTP request smuggling, caused by a flaw when handling more than one Content-Length headers. By sendin...