USN-3686-1: file vulnerabilities | Cloud Foundry

Severity Low Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Alexander Cherepanov discovered that file incorrectly handled a large number of notes. An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. CVE-2014-9620...

USN-3675-1: GnuPG vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Marcus Brinkmann discovered that during decryption or verification, GnuPG did not properly filter out terminal sequences when reporting the original filename. An attacker could use this to specially craft...

USN-3684-1: Perl vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Affected Cloud Foundry Products and Versions Severity is medium unless otherwise noted. Cloud Foundry BOSH stemcells are vulnerable, including: 3586.x versions prior to 3586.24 3541.x versions prior to...

Security Bulletin: IBM Cloud Private has released a patch in response to the vulnerabilities known as Spectre and Meltdown(CVE-2017-5753, CVE-2017-5715 and CVE-2017-5754)

Summary On Wednesday, January 3, 2018, researchers announced a security vulnerability known as Spectre and Meltdown. These security vulnerabilities are being tracked across three security advisories: CVE-2017-5753, CVE-2017-5715, CVE-2017-5754. Additional details can be found at this link. IBM ha...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affects Liberty for Java for IBM Cloud October 2017 CPU

Summary There are multiple vulnerabiltities in the IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed as part of the IBM Java SDK updates in October 2017. These may affect some configurations of IBM WebSphere Application Server...

Security Bulletin: Information disclosure in Liberty for Java for IBM Cloud (CVE-2017-1681, CVE-2013-6440)

Summary There is a potential information disclosure vulnerability in WebSphere Application Server. There is an information disclosure due to an XML external entity XXE vulnerability when using the OpenSAML features in WebSphere Application Server Liberty. Vulnerability Details CVEID: CVE-2017-168...

Security Bulletin: Cross-site request forgery in Liberty for Java for IBM Bluemix (CVE-2017-1194)

Summary There is a potential cross-site request forgery in WebSphere Application Server OAuth service provider. Vulnerability Details CVEID: CVE-2017-1194 DESCRIPTION: IBM WebSphere Application Server is vulnerable to cross-site request forgery which could allow an attacker to execute malicious a...

Security Bulletin: Multiple security vulnerabilities affect Liberty for Java for IBM Bluemix (CVE-2016-5573, CVE-2016-5597, CVE-2016-5983)

Summary There are multiple vulnerabiltities in the IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed as part of the IBM SDK for Java updates in October 2016. These may affect some configurations of IBM WebSphere Application Server...

Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affects Liberty for Java for IBM Bluemix July 2016 CPU (CVE-2016-3485)

Summary There are multiple vulnerabilities in the IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed in the IBM Java SDK updates in July 2016. These may affect some configurations of Liberty for Java for IBM Bluemix. Vulnerability...

Security Bulletin: Vulnerability in Apache Standard Taglibs affects Liberty for Java for IBM Bluemix (CVE-2015-0254)

Summary There is an XML External Entity Injection XXE vulnerability in the Apache Standard Taglibs that affects IBM WebSphere Application Server. Vulnerability Details CVEID: CVE-2015-0254 DESCRIPTION: Apache Standard Taglibs could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affect Liberty for Java for IBM Bluemix April 2016 CPU (CVE-2016-3426, CVE-2016-3427)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed in the Oracle April 2016 Critical Patch Update, plus four additional vulnerabilities. These may affect some configurations of Liberty...

Security Bulletin: SSL certificate validation disabled through a vulnerability in the Auto-Scaling for Bluemix service agent (CVE-2016-0323)

Summary Liberty for Java applications bound to the Auto-Scaling for Bluemix service have SSL certificate validation disabled through a vulnerability in the agent for the service. The default SSL connection factory for https requests is set to bypass all trust management in this vulnerability...

Security Bulletin: Multiple vulnerabilities in IBM® SDK Java™ Technology Edition affect Liberty for Java for IBM Bluemix January 2016 CPU (CVE-2016-0475, CVE-2016-0466, CVE-2015-7575, CVE-2016-0448)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with Liberty for Java for IBM Bluemix. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and includes the vulnerability commonly referred to as "SLOTH". Vulnerability...

Security Bulletin: Cross-site scripting vulnerability in Liberty for Java for IBM Bluemix (CVE-2015-7417)

Summary There is a cross-site scripting vulnerability in WebSphere Application Server which affects Liberty for Java for IBM Bluemix for any consumers of the OAuth provider output. Vulnerability Details CVEID: CVE-2015-7417 DESCRIPTION: WebSphere Application Server is vulnerable to cross-site...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Liberty for Java for IBM Bluemix (CVE-2015-2590)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 7 and 8 that is used by Liberty for Java for IBM Bluemix. These issues were disclosed as part of the IBM Java SDK updates in July 2015. Vulnerability Details CVEID: CVE-2015-2590 DESCRIPTION: ...

USN-3671-1: Git vulnerabilities | Cloud Foundry

Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Etienne Stalmans discovered that git did not properly validate git submodules files. A remote attacker could possibly use this to craft a git repo that causes arbitrary code execution when “git clone...

USN-3681-1: ImageMagick vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could...

Cloud Foundry Windows 2012R2 stemcells Information Disclosure Vulnerability

Cloud Foundry Windows 2012R2 stemcells are a set of operating system images for deploying Windows virtual machines from the Cloud Foundry Foundation in the United States. An information disclosure vulnerability exists in Cloud Foundry Windows 2012R2 stemcells versions prior to 1200.17. A remote...

Cloud Foundry Loggregator Denial of Service Vulnerability

Cloud Foundry Loggregator is a logging system from the U.S. Cloud Foundry Foundation for use in the Cloud Foundry cloud computing platform. A security vulnerability exists in Cloud Foundry Loggregator, which arises from the program failing to properly close a TCP connection. A remote attacker cou...

Cloud Foundry Diego Privilege Gain Vulnerability

Cloud Foundry Diego is a container management system used in the Cloud Foundry cloud computing platform from the Cloud Foundry Foundation in the United States. A security vulnerability exists in Cloud Foundry Diego versions prior to 2.8.0, which stems from the program's failure to properly filter...