Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum Scale

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by IBM Spectrum Scale. These issues were disclosed as part of the IBM Java SDK updates in Jan 2017. Vulnerability Details CVEID: CVE-2016-5547 DESCRIPTION: An unspecified vulnerability related to the...

Security Bulletin: IBM Spectrum Scale and IBM GPFS are affected by a security vulnerability (CVE-2016-6115)

Summary A security vulnerability has been identified in IBM Spectrum Scale GPFS that could allow a remote authenticated attacker to overflow a buffer and execute arbitrary code on the system with root privileges or cause the server to crash. This vulnerability is only applicable if: - file...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM Process Designer used in IBM Business Automation Workflow, IBM Business Process Manager, and WebSphere Lombardi Edition (CVE-2018-2783)

Summary There is a vulnerability CVE-2018-2783 in IBM® SDK Java™ Technology Edition that is used by IBM Process Designer in IBM Business Automation Workflow, IBM Business Process Manager, and WebSphere Lombardi Edition. The issue was disclosed as part of the IBM Java SDK updates in April 2018...

Security Bulletin: Privilege Escalation / User Impersonation affects IBM Platform LSF and IBM Spectrum LSF

Summary This is to address security vulnerabilities in IBM Spectrum LSF and IBM Platform LSF Load Sharing Facility that could allow a local attacker to impersonate arbitrary users to submit jobs to LSF, and possibly run LSF jobs as root. LSF uses an external authentication framework to secure use...

Security Bulletin: IBM Flex System Manager (FSM) is affected by libpng vulnerabilities (CVE-2015-7981, CVE-2015-8126)

Summary Vulnerabilities have been discovered in libpng that is embedded in the IBM FSM. This bulletin addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2015-8126 DESCRIPTION: libpng is vulnerable to a buffer overflow, caused by improper bounds checking by the pngsetPLTE and...

Security Bulletin: SetGID and SetUID programs in IBM Workload Scheduler can be exploited to obtain privilege escalation (CVE-2018-1386)

Summary SetGID and SetUID programs in IBM Workload Scheduler can be exploited to obtain root privileges Vulnerability Details Some programs in IBM Workload Scheduler are executed with elevated privileges SetGID and SetUID programs and have been compiled to search for libraries in an insecure...

Security Bulletin: OpenSSL command line utility in IBM Workload Scheduler can run with elevated priviliges (CVE-2017-1716)

Summary OpenSSL command line utility in IBM Workload Scheduler has SUID permissions and can run with elevated priviliges Vulnerability Details OpenSSL command line utility in IBM Workload Scheduler, installed in TWS installation directory/TWS/bin/openssl, is installed with SUID permssion, as show...

Security Bulletin: Information disclosure in WebSphere Application Server Liberty affects IBM MessageSight (CVE-2011-4343)

Summary There is an information disclosure vulnerability in IBM WebSphere Application Server Liberty. IBM WebSphere Application Server Liberty is used by IBM MessageSight. IBM MessageSight has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2011-4343 DESCRIPTION: Apache MyFaces cou...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Workload Scheduler

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL is used by IBM Workload Manager. IBM Workload Manager has addressed the applicable CVEs Vulnerability Details CVEID: CVE-2017-3732 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information,...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MessageSight

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 7, 7R1 and 8 used by IBM MessageSight. These issues were disclosed as part of the IBM Java SDK updates in July 2017. Vulnerability Details If you run your own Java code using the IBM Java...

Security Bulletin: Security vulnerabilities have been identified in OpenSSL shipped with IBM Tivoli Network Manager IP Edition(CVE-2016-7055, CVE-2017-3731, CVE-2017-3732)

Summary OpenSSL is shipped with Tivoli Network Manager IP Edition. Information about security vulnerabilities affecting OpenSSL have been published in a security bulletin. Vulnerability Details CVEID: CVE-2017-3731 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager

Summary WebSphere Application Server is shipped with IBM Tivoli System Automation Application Manager. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Tivoli Storage Manager (IBM Spectrum Protect) AIX Client Buffer Overflow (CVE-2016-5985)

Summary The Tivoli Storage Manager IBM Spectrum Protect AIX client is vulnerable to a buffer overflow when Journal-Based Backup is enabled allowing a local attacker to execute arbitrary code on the system or cause a system crash. Vulnerability Details CVEID: CVE-2016-5985 DESCRIPTION: The IBM...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager (CVE-2016-5986)

Summary WebSphere Application Server is shipped with IBM Tivoli System Automation Application Manager. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager (CVE-2016-5983)

Summary WebSphere Application Server is shipped with IBM Tivoli System Automation Application Manager. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin:Multiple vulnerabilities in PCRE affect IBM Tivoli Network Manager IP Edition

Summary Multiple vulnerabilities exist in PCRE v5.x, shipped with IBM Tivoli Network Manager IP Edition. Therefore PCRE 8.35 has been upgraded in IBM Tivoli Network Manager IP Edition. Vulnerability Details CVE-ID: CVE-2015-2327 Description: PCRE is vulnerable to a denial of service, caused by th...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager (CVE-2016-3092)

Summary WebSphere Application Server is shipped with IBM Tivoli System Automation Application Manager. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager (CVE-2016-2960)

Summary WebSphere Application Server is shipped with IBM Tivoli System Automation Application Manager. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager (CVE-2016-3485)

Summary WebSphere Application Server is shipped with IBM Tivoli System Automation Application Manager. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server 8.5 shipped with IBM Tivoli System Automation Application Manager 4.1 (CVE-2015-1885)

Summary WebSphere Application Server 8.5 is shipped as a component of IBM Tivoli System Automation Application Manager 4.1. Information about a security vulnerability affecting WebSphere Application Server 8.5 has been published in a security bulletin. Vulnerability Details Please consult the...