CVE-2023-2597

In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache which is enabled by default in OpenJ9 builds the size of a string is not properly checked against the size of the buffer...

CVE-2023-2597

In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache which is enabled by default in OpenJ9 builds the size of a string is not properly checked against the size of the buffer...

PT-2023-20394 · Eclipse +2 · Eclipse Openj9 +2

Name of the Vulnerable Software and Affected Versions: Eclipse Openj9 versions prior to 0.38.0 Description: The issue is caused by improper bounds checking in the implementation of the shared cache, which is enabled by default in OpenJ9 builds. Specifically, the size of a string is not properly...

CVE-2023-2597

In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache which is enabled by default in OpenJ9 builds the size of a string is not properly checked against the size of the buffer...

Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple vulnerabilities due to IBM Java Runtime

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8 used by IBM Sterling External Authentication Server. IBM Sterling External Authentication Server has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-21628 DESCRIPTION: Java SE is vulnerabl...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple vulnerabilities due to IBM Java Runtime

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8 used by IBM Sterling Secure Proxy. IBM Sterling Secure Proxy has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-21426 DESCRIPTION: An unspecified vulnerability in Java SE related to the...

Security Bulletin: IBM Content Manager Enterprise Edition is affected by a vulnerability in Eclipse Openj9

Summary There is a vulnerability in Eclipse Openj9 used by IBM Content Manager Enterprise Edition. IBM Content Manager Enterprise Edition has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security...

Security Bulletin: CVE-2022-3676 may affect IBM® SDK, Java™ Technology Edition

Summary CVE-2022-3676 was addressed in Eclipse OpenJ9 version 0.35 Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security restrictions, caused by improper runtime type check by the interface calls. By sending a specially-crafted...

CVE-2023-21967 vulnerabilities

Vulnerabilities for packages: openjdk, openjdk-25-openj9, openjdk-11-openj9, openjdk-26-openj9, openjdk-17-openj9, openjdk-21-openj9, openjdk-8-openj9...

CVE-2023-21968 vulnerabilities

Vulnerabilities for packages: openjdk, openjdk-25-openj9, openjdk-11-openj9, openjdk-26-openj9, openjdk-17-openj9, openjdk-21-openj9, openjdk-8-openj9...

CVE-2023-21954 vulnerabilities

Vulnerabilities for packages: openjdk, openjdk-25-openj9, openjdk-11-openj9, openjdk-26-openj9, openjdk-17-openj9, openjdk-21-openj9, openjdk-8-openj9...

CVE-2023-21938 vulnerabilities

Vulnerabilities for packages: openjdk, openjdk-25-openj9, openjdk-11-openj9, openjdk-26-openj9, openjdk-17-openj9, openjdk-21-openj9, openjdk-8-openj9...

CVE-2023-21937 vulnerabilities

Vulnerabilities for packages: openjdk, openjdk-25-openj9, openjdk-11-openj9, openjdk-26-openj9, openjdk-17-openj9, openjdk-21-openj9, openjdk-8-openj9...

CVE-2023-21939 vulnerabilities

Vulnerabilities for packages: openjdk, openjdk-25-openj9, openjdk-11-openj9, openjdk-26-openj9, openjdk-17-openj9, openjdk-21-openj9, openjdk-8-openj9...

Security Bulletin: The IBM® Engineering Lifecycle Engineering product using IBM Java - Eclipse OpenJ9 is vulnerable to CVE-2022-3676

Summary A flaw in Eclipse OpenJ9 leads to type confusion under certain circumstances, which can be exploited to access or modify memory. This may allow malicious untrusted code to elevate its privileges. Following IBM® Engineering Lifecycle Engineering product is vulnerable to this attack, it has...

Security Bulletin: IBM Security Verify Governance is vulnerable to remote security bypass (CVE-2022-3676)

Summary IBM Security Verify Governance is vulnerable to a security bypass due to use of Eclipse Openj9. IBM Security Verify Governance has addressed the issue by upgrading the vulnerable component. Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products

Summary Multiple vulnerabilities in the IBM® Runtime Environment Java™ Technology Edition affect IBM SAN Volume Controller, IBM Storwize V7000, V5000, V3700 and V3500, IBM Spectrum Virtualize Software, IBM Spectrum Virtualize for Public Cloud and IBM FlashSystem V9000 and 9100 family products. Th...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Oct 2022 - Includes Oracle October 2022 CPU and IBM Java - OpenJ9 CVE-2022-3676

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 8 that are used by Rational Software Architect Designer and Rational Software Architect Designer for Websphere Software. These issues were disclosed as part of the IBM Java SDK updates in Oct 2022 and IBM Ja...

Security Bulletin: Multiple vulnerabilities in IBM Semeru Runtime affect z/Transaction Processing Facility

Summary There are multiple vulnerabilities in IBM® Semeru Runtime Certified Edition 11 that is used by the z/TPF system. z/TPF has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-21628 DESCRIPTION: Java SE is vulnerable to a denial of service, caused by a flaw in the Lightweig...

Security Bulletin: CVE-2022-3676 may affect IBM CICS TX Standard

Summary Eclipse Openj9 with IBM Java could allow a remote attacker to bypass security restrictions, caused by improper runtime type check by the interface calls. By sending a specially-crafted request using bytecode, an attacker could exploit this vulnerability to access or modify memory. This...