Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects FileNet Content Manager, IBM Content Foundation and FileNet Business Process Manager. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to...

Security Bulletin: Two vulnerabilities exist in IBM FileNet Content Manager and IBM Content Foundation (CVE-2015-0474 and CVE-2015-0493)

Summary Oracle Outside In Technology vulnerabilities were disclosed on April 14, 2015 by Oracle. These vulnerabilities are documented in CVE-2015-0474 and CVE-2015-0493 and affect the IBM FileNet Content Manager and IBM Content Foundation products. Vulnerability Details CVEID: CVE-2015-0474...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-0488, CVE-2015-0478, CVE-2015-1916)

Summary There are multiple vulnerabilities in the IBM Runtime Environment Java Technology Edition used by FileNet Content Manager, IBM Content Foundation and FileNet Business Process Manager. These issues are addressed in Version 1.6.0 SR16 FP4 which is part of the IBM Java SDK April 2015 update...

Security Bulletin: Apache Xalan-Java の脆弱性 (CVE-2014-0107) による IBM FileNet Business Process Framework への影響

Summary Apache Xalan-Java にはリモートの攻撃者がセキュリティの制限をバイパスできてしまうおそれがあります。 ご利用の IBM FileNet Business Process Framework V4.1.0.x に4.1 Fix Pack 10 を適用後、4.1.0.10-P8BPF-IF002 を適用してください。修正を適用する以外の回避策はございません。 Vulnerability Details 影響を受ける製品およびバージョン： · IBM FileNet Business Process Framework V4.1.0.x 解決策および回避策：...

Security Bulletin: ClassLoader manipulation with Apache Struts affecting IBM Records Manager, IBM Content Manager Records Enabler and WebSphere Application Server shipped with IBM Records Manager (CVE-2014-0114)

Summary There is a ClassLoader manipulation vulnerability in Apache Struts that is used by IBM Records Manager and IBM Content Manager Records Enabler. The security vulnerability has also been identified in WebSphere Application Server shipped with IBM Records Manager. Vulnerability Details CVEID...

Security Bulletin: Vulnerability in IBM Java SDK affects Rational Lifecycle Integration Adapter for HP ALM (CVE-2015-7575)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 6.0.16.2 that is used by Rational Lifecycle Integration Adapter for HP ALM. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details...

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects RIT and RTCP in Rational Test Workbench, RTCP and RIT Agent in Rational Test Virtualization Server, and RIT Agent in Rational Performance Test Server (CVE-2015-7575)

Summary The MD5 “SLOTH” vulnerability on TLS 1.2 affects Rational Integration Tester and Rational Test Control Panel in Rational Test Workbench, Rational Test Control Panel and RIT Agent in Rational Test Virtualization Server, and RIT Agent in Rational Performance Test Server Vulnerability Detail...

Security Bulletin: Vulnerability in Spring Framework for Java Deserialization in Rational Test Control Panel in Rational Test Workbench and Rational Test Virtualization Server (CVE-2015-7450)

Summary A Spring Framework vulnerability for handling Java object deserialization was addressed by Rational Test Control Panel in Rational Test Workbench and Rational Test Virtualization Server. This vulnerability does not have its own CVE number, but is linked to CVE-2015-7450. Vulnerability...

Security Bulletin: Vulnerability in Apache Commons affects RIT and RTCP in Rational Test Workbench, RTCP and RIT Agent in Rational Test Virtualization Server, and RIT Agent in Rational Performance Test Server (CVE-2015-7450)

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by Rational Integration Tester in Rational Test Workbench, Rational Test Control Panel in Rational Test Workbench and Rational Test Virtualization Server, and RIT Agent in Rational Test...

Security Bulletin: Vulnerability in IBM Java SDK affects Rational Lifecycle Integration Adapter for HP ALM (CVE-2015-0138)

Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects IBM® SDK Java™ Technology Edition, Version 6.0.16.2, that is used by Rational Lifecycle Integration Adapter for HP ALM. Vulnerability Details CVEID: CVE-2015-0138 DESCRIPTION: A vulnerability ...

Security Bulletin: Vulnerabilities in GSKit affect IBM Rational RequisitePro (CVE-2015-0138)

Summary GSKit is an IBM component that is used by IBM Rational RequisitePro. The GSKit that is shipped with IBM Rational RequisitePro contains multiple security vulnerabilities including the “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. IBM Rational...

Security Bulletin: Rational Integration Tester component in Rational Test Workbench affected by Netty vulnerability (CVE-2014-3488)

Summary The Netty library is vulnerable affecting the Rational Integration Tester component in IBM Rational Test Workbench. Vulnerability Details CVE ID: CVE-2014-3488 Description: Netty is vulnerable to a denial of service, caused by an error in SslHandler. A remote attacker could exploit this...

Security Bulletin: Rational Test Control Panel component in Rational Test Workbench and Rational Test Virtualization Server affected by Castor Library vulnerablity (CVE-2014-3004)

Summary The Castor Project Castor library is vulnerable affecting the Rational Test Control Panel component in IBM Rational Test Workbench and Rational Test Virtualization Server. Vulnerability Details CVE ID: CVE-2014-3004 Description: Castor Library could allow a remote attacker to obtain...

Security Bulletin: Vulnerabilities in unzip affect IBM Security Network Protection (CVE-2014-8139, CVE-2014-8140, CVE-2014-8141, and CVE-2014-9636 )

Summary The unzip utility is used to list, test, or extract files from a zip archive. Security vulnerabilities have been discovered in unzip used with IBM Security Network Protection. Vulnerability Details CVE ID: CVE-2014-8139 DESCRIPTION: Info-ZIP UnZip is vulnerable to a heap-based buffer...

Security Bulletin: Multiple Vulnerabilities in IBM Java SDK Affect IBM B2B Advanced Communications

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 Service Refresh 10 Fix Pack 10 that is used by IBM B2B Advanced Communications. This issue was disclosed as part of the IBM Java SDK updates in October 2017 Vulnerability Details CVEID: CVE-2017-10295...

Security Bulletin: Vulnerabilities in the GSKit component of IBM Transformation Extender Hypervisor Edition for AIX (CVE-2016-0201, CVE-2015-7421, CVE-2015-7420)

Summary Vulnerabilities have been addressed in the GSKit component of IBM Transformation Extender Hypervisor Edition for AIX. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker cou...

Security Bulletin: IBM Sterling B2B Integrator is affected by Click jacking vulnerability (CVE-2015-4992)

Summary A Click jacking also known as a "UI redress attack" vulnerability has been discovered in IBM Sterling B2B Integrator. Vulnerability Details CVEID: CVE-2015-4992 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to hijack the clicking action of the...

Security Bulletin: GNU C library (glibc) vulnerability affects WebSphere Transformation Extender with Launcher Hypervisor Edition [for RHEL] (CVE-2015-0235)

Summary GNU C library glibc vulnerability that has been referred to as GHOST affects WebSphere Transformation Extender with Launcher Hypervisor Edition for RHEL. Vulnerability Details CVEID: CVE-2015-0235 DESCRIPTION: The gethostbyname functions of the GNU C Library glibc are vulnerable to a buff...

Security Bulletin: There is a weak ciphers vulnerability in IBM Streams

Summary There is a vulnerability in IBM Streams where weak ciphers may be enabled when Transport Layer Security is enabled. Vulnerability Details CVEID: CVE-2017-1713 DESCRIPTION: IBM InfoSphere Streams uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt...

Security Bulletin: IBM Netezza Host Management is affected by the vulnerabilities known as Spectre and Meltdown.

Summary IBM Netezza Host Management is affected by the vulnerabilities known as Spectre and Meltdown, which can enable CPU data cache timing to be abused to bypass conventional memory security restrictions to gain access to privileged memory that should be inaccessible. Vulnerability Details CVEI...