Security Bulletin: A vulnerability in the GSKit component of IBM Tivoli Storage Manager (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit component of IBM Tivoli Storage Manager IBM Spectrum Protect Client/API and Server. Bulletin update: 7.1.5 server and 7.1.4.4 AIX, Linux x86, Windows client fixes are available. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSK...

Security Bulletin: Vulnerability in OpenSSL affects Tivoli Storage FlashCopy Manager Unix and VMware (CVE-2015-1788)

Summary An OpenSSL denial of service vulnerability disclosed by the OpenSSL Project affects GSKit. Tivoli Storage Manager Unix and VMware are affected as GSKit is used for communication between FCM components. Vulnerability Details CVEID: CVE-2015-1788 DESCRIPTION: OpenSSL is vulnerable to a deni...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Tivoli Storage FlashCopy Manager on Solaris and HP-UX platforms (CVE-2015-0383)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition that is used by FlashCopy Manager. These issues were disclosed as part of the IBM Java SDK updates in January 2015. Vulnerability Details CVEID: CVE-2015-0383 DESCRIPTION: An unspecified vulnerability ...

Security Bulletin: TSM client SetUID elevation of privilege (CVE-2014-0907)

Summary A vulnerability in the IBM Tivoli Storage Manager TSM AIX and HP-UX clients could allow a local user to gain elevated privilege. Vulnerability Details CVE ID: CVE-2014-0907 DESCRIPTION: The IBM Tivoli Storage Manager TSM AIX and HP-UX client binaries have been compiled in an insecure way....

Security Bulletin: Vulnerability in IBM Java SDK affects Rational Lifecycle Integration Adapter for HP ALM (CVE-2016-5597)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 6.0.16.2 that is used by Rational Lifecycle Integration Adapter for HP ALM. This vulnerability was disclosed as part of the IBM Java SDK updates in October 2016. Vulnerability Details If you run your own Java code usin...

Security Bulletin: Vulnerability in Apache Tomcat affects Rational Lifecycle Integration Adapter for HP ALM (CVE-2016-3092)

Summary Apache Tomcat is vulnerable to a denial of service, caused by an error in the Apache Commons FileUpload component, and is supplied with specific versions of Rational Lifecycle Integration Adapter for HP ALM. By sending file upload requests, an attacker could exploit this vulnerability to...

Security Bulletin: Vulnerability in Apache Tomcat affects Rational Lifecycle Integration Adapter for HP ALM (CVE-2015-5345, CVE-2016-0706, CVE-2016-0714)

Summary Apache Tomcat could allow a remote attacker to obtain sensitive information or bypass security restrictions and is supplied with specific versions of Rational Lifecycle Integration Adapter for HP ALM. Vulnerability Details CVE Information: CVE-ID: CVE-2015-5345 Description: Apache Tomcat...

Security Bulletin: Vulnerability in IBM Java SDK affects Rational Lifecycle Integration Adapter for HP ALM (CVE-2015-7575)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 6.0.16.2 that is used by Rational Lifecycle Integration Adapter for HP ALM. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Lifecycle Integration Adapter for HP ALM (CVE-2015-0138, CVE-2014-6549, CVE-2015-0408, CVE-2015-0412, CVE-2015-0395, CVE-2015-0403, CVE-2015-0406, CVE-2015-0410, CVE-2015-0407,

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6.0.16.2 that is supplied with specific versions of Rational Lifecycle Integration Adapter for HP ALM. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also...

Security Bulletin: Vulnerability in RC4 stream cipher affects Rational Lifecycle Integration Adapter for HP ALM (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM® SDK Java™ Technology Edition, Version 6.0.16.2, that is supplied with specific versions of Rational Lifecycle Integration Adapter for HP ALM. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION:The RC4 algorithm, as used in the TLS...

Security Bulletin: Vulnerability in IBM Java SDK affects Rational Lifecycle Integration Adapter for HP ALM (CVE-2015-0138)

Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects IBM® SDK Java™ Technology Edition, Version 6.0.16.2, that is used by Rational Lifecycle Integration Adapter for HP ALM. Vulnerability Details CVEID: CVE-2015-0138 DESCRIPTION: A vulnerability ...

Security Bulletin: Rational Lifecycle Adapter for HP ALM Apache Tomcat fix (CVE-2013-4286, CVE-2014-0033, CVE-2013-4322, CVE-2013-4590, CVE-2014-0075, CVE-2014-0095, CVE-2014-0096, CVE-2014-0099, CVE-2014-0119)

Summary A vulnerability has been identified in Rational Lifecycle Adapter for HP ALM V1.0 and V1.1. If you are using Apache Tomcat 7.x to run your HP ALM adapter, download and install the Apache Tomcat fix available on Fix Central. Vulnerability Details | Subscribe to My Notifications to be...

Security Bulletin: Rational License Key Server vulnerability affecting license server, lmgrd, and the vendor daemon, ibmratl (CVE-2011-1389)

Summary A possible security vulnerability has been reported in the FlexNet Publisher lmgrd license server manager as well as vendor daemons. There have been no reported exploits of this possible vulnerability, and to date it has not been reported by FlexNetSoftware users. Vulnerability Details |...

Security Bulletin: IBM WebSphere Transformation Extender Secure Adapter Collection vulnerabilities: RSA BSAFE-C (CVE-2014-4191, CVE-2014-4192) and SSLv3 (CVE-2014-3566)

Summary EMC RSA BSAFE-C Toolkits, utilized by WebSphere Transformation Extender Secure Adapter Collection, could allow a remote attacker to obtain sensitive information. Additionally, SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption...

Security Bulletin: Multiple security vulnerabilities exist in WebSphere Transformation Extender (CVE-2013-5802 CVE-2013-4002 CVE-2013-5825 CVE-2013-5372 CVE-2013-0599 CVE-2013-0464 CVE-2013-0467 CVE-2013-2962 CVE-2013-2415)

Summary WebSphere Transformation Extender products are affected by multiple security vulnerabilities that exist in Oracle JRE and IBM Eclipse Help System. Additionally, WTX Launcher is vulnerable to a denial of service attack using a buffer overflow. Vulnerability Details WebSphere Transformation...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM ILOG CPLEX Optimization Studio

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 6, 7 and 8 used by IBM ILOG CPLEX Optimization Studio. These issues were disclosed as part of the IBM Java SDK updates in April 2018. Vulnerability Details If you run your own Java code using the IBM Java Runtim...

Security Bulletin: Buffer overflow vulnerability in IBM® DB2® LUW (CVE-2017-1105)

Summary IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server is vulnerable to a buffer overflow that could allow a local user to overwrite DB2 files or cause a denial of service. Vulnerability Details CVEID: CVE-2017-1105 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM ILOG CPLEX Optimization Studio

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 6, 7 and 8 used by IBM ILOG CPLEX Optimization Studio. These issues were disclosed as part of the IBM Java SDK updates in January 2017. Vulnerability Details If you run your own Java code using the IBM Java...

Security Bulletin: Vulnerabilty in XMLC affects IBM® DB2® LUW (CVE-2016-0729, CVE-2016-4463)

Summary IBM DB2 for LUW bundles a XMLC library that is affected by CVE-2016-0729. A remote, authenticated DB2 user could exploit this vulnerability by issuing a specially crafted statement. This may cause the DB2 server to terminate abnormally or execute arbitary code. Vulnerability Details CVE-I...

Security Bulletin: IBM® DB2® LUW contains a denial of service vulnerability in which a malformated DRDA message may cause the DB2 server to terminate abnormally (CVE-2016-0211)

Summary IBM DB2 LUW contains a denial of service vulnerability. A remote, authenticated DB2 user could exploit this vulnerability by issuing a specially-crafted DRDA message and cause DB2 server to terminate abnormally. Vulnerability Details CVEID: CVE-2016-0211 DESCRIPTION: IBM DB2 LUW contains ...