Security Bulletin: Security vulnerabilities have been identified in OpenSSL, IBM Java Runtime and the microcode shipped with the DS8000 Hardware Management Console (HMC)

Summary The updates indicated below have been released to address the following vulnerabilities: CVE-2016-2107 MITM attack in OpenSSL, CVE-2016-5547 Denial of service in IBM Runtime Environment Java™ CVE-2017-1123 Escalation of privilege in the DS8000 HMC Vulnerability Details CVEID: CVE-2016-210...

Security Bulletin: Vulnerability in IBM Java SDK Runtime affects DS8000 (CVE-2015-0138)

Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects some versions of DS8000. Vulnerability Details CVEID: CVE-2015-0138 DESCRIPTION: A vulnerability in SSL/TLS implementations could allow a remote attacker to downgrade the security of certain...

Security Bulletin:Multiple vulnerabilities in IBM Java SDK affect System Storage DS8000

Summary Multiple vulnerabilities exisit in the IBM JRE used by System Storage DS8000. These were disclosed as part of the IBM Java SDK updates - July 2015 This release also enforces the removal of RC4 in IBM JAVA CVE-2015-2808 also known as BarMitzva to ensure that no present or future releases c...

Security Bulletin: A vulnerability in IBM Java SDK affects IBM Standards Processing Engine and IBM Transformation Extender Advanced (CVE-2015-4872)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 7 and 8, that is used by IBM Standards Processing Engine and IBM Transformation Extender Advanced. This issue was disclosed as part of the IBM Java SDK updates for October 2015. Vulnerability Details CVEID: CVE-2015-48...

GHSA-7J4H-8WPF-RQFH Missing XML Validation in Apache Xerces2

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment JRE in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlie...

Security Bulletin: A vulnerability in IBM® SDK, Java™ may affect Rational Asset Analyzer (CVE-2021-35550)

Summary There is a vulnerability in IBM® Java™ version 8 used by Rational Asset Analyzer. This has been addressed. Vulnerability Details CVEID:CVE-2021-35550 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain...

Security Bulletin: A vulnerability in IBM® SDK, Java™ affects Rational Asset Analyzer (CVE-2021-35603)

Summary There is a vulnerability in IBM® Java™ version 8 used by Rational Asset Analyzer. This has been addressed. Vulnerability Details CVEID:CVE-2021-35603 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain...

Security Bulletin: Vulnerability in IBM JAVA JDK affects IBM Spectrum Scale (CVE-2022-21291)

Summary A vulnerability in IBM JAVA JDK could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact. This library is used by the Graphical User Interface GUI of IBM Spectrum Scale. Vulnerability Details CVEID: CVE-2022-21291...

IBM Java 6.0 < 6.0.16.50 / 6.1 < 6.1.8.50 / 7.0 < 7.0.10.10 / 7.1 < 7.1.4.10 / 8.0 < 8.0.4.10 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is prior to 6.0 6.0.16.50 / 6.1 6.1.8.50 / 7.0 7.0.10.10 / 7.1 7.1.4.10 / 8.0 8.0.4.10. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle July 18 2017 CPU advisory. - Vulnerability in the Java SE, Java SE...

IBM Java 7.0 < 7.0.11.5 / 7.1 < 7.1.5.5 / 8.0 < 8.0.7.5 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is prior to 7.0 7.0.11.5 / 7.1 7.1.5.5 / 8.0 8.0.7.5. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle January 18 2022 CPU advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition...

IBM Java 7.0 < 7.0.10.70 / 7.1 < 7.1.4.70 / 8.0 < 8.0.6.15

The version of IBM Java installed on the remote host is prior to 7.0 7.0.10.70 / 7.1 7.1.4.70 / 8.0 8.0.6.15. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update August 2020 advisory. - In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the...

IBM Java 7.0 < 7.0.10.45 / 7.1 < 7.1.4.45 / 8.0 < 8.0.5.35

The version of IBM Java installed on the remote host is prior to 7.0 7.0.10.45 / 7.1 7.1.4.45 / 8.0 8.0.5.35. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update April 2019 advisory. - In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier...

IBM Java 7.0 < 7.0.10.80 / 7.1 < 7.1.4.80 / 8.0 < 8.0.6.25 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is prior to 7.0 7.0.10.80 / 7.1 7.1.4.80 / 8.0 8.0.6.25. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle October 20 2020 CPU advisory. - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE...

IBM Java 6.0 < 6.0.16.45 / 6.1 < 6.1.8.45 / 7.0 < 7.0.10.5 / 7.1 < 7.1.4.5 / 8.0 < 8.0.4.5 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is prior to 6.0 6.0.16.45 / 6.1 6.1.8.45 / 7.0 7.0.10.5 / 7.1 7.1.4.5 / 8.0 8.0.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Update May 2017 advisory. - inftrees.c in zlib 1.2.8 might allow...

IBM Java 7.0 < 7.0.11.0 / 7.1 < 7.1.5.0 / 8.0 < 8.0.6.35 / 11.0 < 11.0.12 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is prior to 7.0 7.0.11.0 / 7.1 7.1.5.0 / 8.0 8.0.6.35 / 11.0 11.0.12. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle July 20 2021 CPU advisory. - Vulnerability in the Java SE, Oracle GraalVM Enterprise Editio...

IBM Java 6.1 < 6.1.8.50 / 7.0 < 7.0.10.10 / 7.1 < 7.1.4.10 / 8.0 < 8.0.4.7

The version of IBM Java installed on the remote host is prior to 6.1 6.1.8.50 / 7.0 7.0.10.10 / 7.1 7.1.4.10 / 8.0 8.0.4.7. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update August 2017 advisory. - A flaw in the IBM J9 VM class verifier allows untrusted code t...

IBM Java 6.0 < 6.0.16.70 / 6.1 < 6.1.8.70 / 7.0 < 7.0.10.30 / 7.1 < 7.1.4.30 / 8.0 < 8.0.5.20 Multiple Vulnerabilities (Jul 17, 2018)

The version of IBM Java installed on the remote host is prior to 6.0 6.0.16.70 / 6.1 6.1.8.70 / 7.0 7.0.10.30 / 7.1 7.1.4.30 / 8.0 8.0.5.20. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle July 17 2018 CPU advisory. - Vulnerability in the Java SE, Java SE Embedd...

IBM Java 8.0 < 8.0.6.5

The version of IBM Java installed on the remote host is prior to 8.0 8.0.6.5. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update January 2020 advisory. - IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0...

IBM Java 7.1 < 7.1.4.80 / 8.0 < 8.0.6.25 / 11.0 < 11.0.10.0

The version of IBM Java installed on the remote host is prior to 7.1 7.1.4.80 / 8.0 8.0.6.25 / 11.0 11.0.10.0. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update February 2021 advisory. - In Eclipse OpenJ9 up to and including version 0.23, there is potential fo...

IBM Java 7.0 < 7.0.10.50 / 7.1 < 7.1.4.50 / 8.0 < 8.0.5.40 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is prior to 7.0 7.0.10.50 / 7.1 7.1.4.50 / 8.0 8.0.5.40. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle July 16 2019 CPU advisory. - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE...