Security Bulletin: Multiple vulnerabilities in scala-compiler-2.11.8.jar affect IBM Application Performance Management products

Summary There are multiple vulnerabilities in scala-compiler-2.11.8.jar used by IBM Application Performance Management. IBM Application Performance Management has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2017-15288 DESCRIPTION: Scala could allow a local authenticated attacke...

GLSA-201812-08 : Scala: Privilege escalation

The remote host is affected by the vulnerability described in GLSA-201812-08 Scala: Privilege escalation It was discovered that Scalas compilation daemon does not properly manage permissions for private files. Impact : A local attacker could escalate privileges. Workaround : There is no known...

ai.x:play-json-extensions_2.12 (0.10.0), at.iem:sysson_2.12 (>=1.13.0, <=1.16.0) +1197 more potentially affected by CVE-2017-15288 via org.scala-lang:scala-compiler (>=2.12.0, <=2.12.3)

org.scala-lang:scala-compiler MAVEN version =2.12.0, =1.13.0, =3.5.4-rc.0, =3.5.9, =3.5.4-rc.0, =3.5.4-rc.0, =3.5.4-rc.0, =3.5.4-rc.0, =3.5.4-rc.0, =3.5.4-rc.0, =3.5.4-rc.0, =3.5.4-rc.0, =3.5.4-rc.0, =3.5.13 and more Source cves: CVE-2017-15288 Source advisory: GHSA-QVXV-PMQ9-4Q7G...

ai.grakn:client-java (1.3.0), ai.grakn:grakn-bootup (>=v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, <=1.2.0) +3852 more potentially affected by CVE-2017-15288 via org.scala-lang:scala-compiler (>=2.6.1-rc1, <=2.10.6)

org.scala-lang:scala-compiler MAVEN version =2.6.1-rc1, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...

CVE-2017-15288

The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/$USER:shared/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges. Mitigati...

UBUNTU-CVE-2017-15288

The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/$USER:shared/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges...

ai.x:play-json-extensions_2.12 (0.10.0), at.iem:sysson_2.12 (>=1.13.0, <=1.16.0) +1197 more potentially affected by CVE-2017-15288 via org.scala-lang:scala-compiler (>=2.12.0, <=2.12.3)

org.scala-lang:scala-compiler MAVEN version =2.12.0, =1.13.0, =3.5.4-rc.0, =3.5.9, =3.5.4-rc.0, =3.5.4-rc.0, =3.5.4-rc.0, =3.5.4-rc.0, =3.5.4-rc.0, =3.5.4-rc.0, =3.5.4-rc.0, =3.5.4-rc.0, =3.5.4-rc.0, =3.5.13 and more Source cves: CVE-2017-15288 Source advisory: MEND:CVE-2017-15288...

ae.teletronics.nlp:entityextraction (1.3), ai.catboost:catboost-spark_2.3_2.11 (>=0.25, <=1.2.7) +3609 more potentially affected by CVE-2017-15288 via org.scala-lang:scala-compiler (>=2.11.0, <=2.11.11)

org.scala-lang:scala-compiler MAVEN version =2.11.0, =0.25, =0.42.1, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.4.1, =2.0.0, =3.34.0.3-1-2.2, =2.0.0, =2.0.0, =2.0.18, =2.0.0, =2.2.10 and more Source cves: CVE-2017-15288 Source advisory: MEND:CVE-2017-15288...

CVE-2017-15288

CVE-2017-15288 affects the Scala compilation daemon. The root cause is weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, allowing a local user to overwrite arbitrary class files and escalate privileges. Affected branches: Scala pre-2.10.7, 2.11.x be...