Security Bulletin: InfoSphere Replication Dashboard is affected by a vulnerability in the IBM Runtime Environment, Java Technology Edition (CVE-2014-4263)

Summary There are multiple vulnerabilities in IBM Runtime Environment Java Technology Edition, Version 7.1.1.0 that is used by InfoSphere Replication Dashboard. These issues were disclosed as part of the IBM Java SDK updates in July 2014. IBM InfoSphere Replication Dashboard is affected by a sing...

Security Bulletin: InfoSphere Data Replication Dashboard is affected by a vulnerability in the IBM Runtime Environment, Java™ Technology Edition (CVE-2014-0453)

Summary An unspecified vulnerability related to the Security component has partial confidentiality impact, partial integrity impact, and no availability impact. Vulnerability Details CVE ID: CVE-2014-0453 CVSS: CVSS Base Score: 4 CVSS Temporal Score: See for the current score CVSS Environmental...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM InfoSphere Information Server

Summary OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM InfoSphere Information Server. IBM InfoSphere Information Server has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-0799 DESCRIPTION: OpenSSL could allow a remote...

Security Bulletin: Multiple IBM InfoSphere Information Server components are vulnerable due to the following Castor Library vulnerability (CVE-2014-3004)

Summary Castor Library could allow a remote attacker to obtain sensitive information in various IBM Information Server components. This is caused by an XML External Entity Injection XXE error when processing XML data. By sending specially-crafted XML data, an attacker could exploit this...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM InfoSphere Discovery (CVE-2016-3485)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 6 that is used by IBM InfoSphere Discovery. This issue was disclosed as part of the IBM Java SDK updates in July 2016. Vulnerability Details CVEID: CVE-2016-3485 DESCRIPTION: An unspecified vulnerability related to the...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM InfoSphere Information Server (CVE-2016-3426 CVE-2016-3427)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 6 and 7 that are used by IBM InfoSphere Information Server. These issues were disclosed as part of the IBM Java SDK updates in April 2016. Vulnerability Details CVEID: CVE-2016-3426 DESCRIPTION: An unspecifi...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM InfoSphere Discovery (CVE-2016-0264, CVE-2016-3426)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 that is used by IBM InfoSphere Discovery. This issue was disclosed as part of the IBM Java SDK updates in April 2016. Vulnerability Details CVEID: CVE-2016-0264 DESCRIPTION: A buffer overflow vulnerability ...

Security Bulletin: Vulnerability in IBM InfoSphere Information Server installer could expose sensitive information (CVE-2015-7493)

Summary IBM InfoSphere Information Server could allow a local user under special circumstances to execute commands during installation processes that could expose sensitive information. Vulnerability Details CVEID:CVE-2015-7493 DESCRIPTION: IBM InfoSphere Information Server could allow a local us...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM InfoSphere Information Server (CVE-2015-3193, CVE-2015-3194, CVE-2015-3195, CVE-2016-0701)

Summary OpenSSL vulnerabilities were disclosed on December 3, 2015 and January 28, 2016 by the OpenSSL Project. OpenSSL is used by IBM InfoSphere Information Server. IBM InfoSphere Information Server has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-3193 DESCRIPTION: OpenSS...

Security Bulletin: IBM InfoSphere Information Governance Catalog is vulnerable to XXE Injection Attack (CVE-2016-0250)

Summary IBM InfoSphere Information Governance Catalog could allow a remote authenticated attacker to obtain sensitive information, caused by a XML external entity XXE error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on th...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM InfoSphere Discovery (CVE-2015-7575)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 6 that is used by IBM InfoSphere Discovery. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to privilege escalation (CVE-2015-5021)

Summary IBM InfoSphere Information Server could allow an authenticated user of DataStage to view sensitive information or execute jobs even though the user does not have the proper privileges to do so. Vulnerability Details CVEID: CVE-2015-5021 DESCRIPTION: IBM InfoSphere Information Server could...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM InfoSphere Information Server (CVE-2015-1931 CVE-2015-2601 CVE-2015-2613 CVE-2015-2625)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 6 and 7 that are used by IBM InfoSphere Information Server. These issues were disclosed as part of the IBM Java SDK updates in July 2015. Vulnerability Details CVEID: CVE-2015-1931 DESCRIPTION: IBM Java...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM InfoSphere Information Server

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project. This includes the alternate chains certificate forgery vulnerability CVE-2015-1793. OpenSSL is used by the Progress Software DataDirect Connect ODBC drivers which are shipped as a component of IBM InfoSphere Information Server...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and in Diffie-Hellman ciphers affects IBM InfoSphere Information Server (CVE-2015-0478 CVE-2015-0488 CVE-2015-1916 CVE-2015-4000)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 6 and 7 that are used by IBM InfoSphere Information Server. These issues were disclosed as part of the IBM Java SDK updates in April 2015. This bulletin also addresses the Logjam Attack on TLS connections...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM InfoSphere Information Server (CVE-2015-0204 CVE-2014-8275 CVE-2014-3570 CVE-2015-0286 CVE-2015-0292 CVE-2015-0293 CVE-2015-0209 CVE-2015-0288)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 and March 19, 2015 by the OpenSSL Project. This includes “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by IBM InfoSphere Information Server. IBM InfoSphere Information Server...

Security Bulletin: Vulnerability in IBM InfoSphere Information Server installer could expose sensitive information (CVE-2015-1901)

Summary IBM InfoSphere Information Server could allow a local user under special circumstances to execute commands during installation processes that could expose sensitive information. Vulnerability Details CVE-ID: CVE-2015-1901 DESCRIPTION: IBM InfoSphere Information Server could allow a local...

Security Bulletin: Multiple vulnerabilities in Open Source Apache WSS4J affect IBM InfoSphere DataStage Web services pack (CVE-2015-0226 CVE-2015-0227)

Summary There are multiple vulnerabilities in Open Source Apache WSS4J that is used by IBM InfoSphere DataStage Web services pack. Vulnerability Details CVE-ID: CVE-2015-0226 DESCRIPTION : Apache WSS4J could allow a remote attacker to obtain sensitive information, caused by Bleichenbacher's attac...

Security Bulletin: Information Server Connector Migration Tool allows a user with limited role to create/modify/replace some jobs (CVE-2015-0180)

Summary A user with limited role may be able to create/modify/delete specific types of jobs. Vulnerability Details CVEID: CVE-2015-0180 DESCRIPTION: IBM Information Server Connector Migration Tool could allow a user with limited role to create/modify/delete specific types of jobs that they do not...

Security Bulletin: Multiple IBM InfoSphere Information Server components are affected by a vulnerability in the XML4C parser (CVE-2014-8901)

Summary Multiple components of IBM InfoSphere Information Server may be affected by a denial of service attack triggered by a specially crafted XML document being parsed by the XML4C parser. Vulnerability Details CVEID: CVE-2014-8901 DESCRIPTION: IBM XML4J and XML4C contains a denial of service...