Security Bulletin: Multiple vulnerabilities in IBM SDK Java Technology Edition, Versions 1.5, 1.6 and 1.7 affect IBM SPSS Collaboration and Deployment Services: (CVE-2015-0138, CVE-2014-6593, CVE-2015-0410)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Versions 1.5, 1.6 and 1.7 that are used by IBM SPSS Collaboration and Deployment Services. These issues were disclosed as part of the IBM Java SDK updates in January 2015 and the “FREAK: Factoring Attack on RSA-EXPORT...

Security Bulletin: Vulnerability in RC4 stream cipher in IBM SDK Java Technology Edition, Versions 1.6 and 1.7 affects IBM SPSS Collaboration and Deployment Services (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM SPSS Collaboration and Deployment Services. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An...

Security Bulletin: IBM® DB2® XML Query Will Cause Excessive CPU Usage (CVE-2014-8901)

Summary IBM DB2 contains a security vulnerability which could allow a remote, authenticated user to exploit a vulnerability in DB2's XML library to cause a disruption of service. Vulnerability Details CVE ID: CVE-2014-8901 DESCRIPTION: IBM DB2 contains a disruption of service vulnerability. A...

Security Bulletin: IBM® DB2® LUW contains a vulnerability in which an ALTER TABLE statement on identity column may cause the DB2 server to terminate abnormally. (CVE-2014-6209)

Summary IBM DB2 contains a denial of service vulnerability in which an ALTER TABLE statement on identity column may cause the DB2 server to terminate abnormally. Vulnerability Details CVE-ID: CVE-2014-6209 DESCRIPTION: IBM DB2 contains a denial of service vulnerability. A remote, authenticated DB...

Security Bulletin: A vulnerability in the Apache Xerces-C XML Parser affects IBM Cognos Metrics Manager.

Summary A vulnerability has been addressed in the Apache Xerces-C XML Parser component of IBM Cognos Metrics Manager. Vulnerability Details CVEID: CVE-2016-4463 DESCRIPTION: Apache Xerces-C XML Parser library is vulnerable to a denial of service, caused by a stack-based buffer overflow when parsi...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Cognos Metrics Manager

Summary Vulnerabilities were addressed the OpenSSL component used by IBM Cognos Metrics Manager. Vulnerability Details CVEID: CVE-2017-3732 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a propagation error in the BNmodexp function. An attacker could...

Security Bulletin: A vulnerability in the GSKit library affects IBM Cognos Metrics Manager

Summary A vulnerability has been addressed in the GSKit component of IBM Cognos Metrics Manager. Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS...

Security Bulletin: A vulnerability in the libpng library affects IBM Cognos Metrics Manager

Summary A vulnerability has been addressed in the libpng component of IBM Cognos Metrics Manager. Vulnerability Details CVEID: CVE-2016-10087 DESCRIPTION: libpng is vulnerable to a denial of service, caused by a NULL pointer dereference in the pngsettext2 function. By loading a text chunk into a...

Security Bulletin: A vulnerability in IBM Websphere Application Server affects IBM Cognos Metrics Manager (CVE-2016-5983)

Summary A vulnerability has been addressed in the IBM WebSphere Application Server Liberty Profile component of IBM Cognos Metrics Manager. Vulnerability Details CVEID: CVE-2016-5983 DESCRIPTION: IBM WebSphere Application Server could allow remote attackers to execute arbitrary Java code with a...

Security Bulletin: A vulnerability in IBM Java Runtime affects IBM Cognos Metrics Manager (CVE-2016-3485)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Versions 6 and 7 that are used by IBM Cognos Metrics Manager. This issue was disclosed as part of the IBM Java SDK updates in July 2016. Vulnerability Details CVEID: CVE-2016-3485 DESCRIPTION: An unspecified vulnerability related ...

Security Bulletin: A vulnerability in the Apache Xerces-C XML parser affects IBM Cognos Metrics Manager (CVE-2016-0729)

Summary A vulnerability has been addressed in the Apache Xerces-C XML parser component of IBM Cognos Metrics Manager. Vulnerability Details CVEID: CVE-2016-0729 DESCRIPTION: Apache Xerces-C XML Parser library is vulnerable to a denial of service, caused by improper bounds checking during processi...

Security Bulletin: A vulnerability in OpenSSL affects IBM Cognos Metrics Manager (CVE-2016-2106, CVE-2016-2107, CVE-2016-2108)

Summary OpenSSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. OpenSSL is used by IBM Cognos Metrics Manager. IBM Cognos Metrics Manager has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2108 DESCRIPTION: OpenSSL could allow a remote attacker to execu...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos Metrics Manager (CVE-2016-0448, CVE-2016-0466)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 6 and 7 that are used by IBM Cognos Metrics Manager. These issues were disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID: CVE-2016-0448 DESCRIPTION: A...

Security Bulletin: Multiple vulnerabilities in libpng affect IBM Cognos Metrics Manager (CVE-2015-8126, CVE-2015-8472, CVE-2015-8540)

Summary The vulnerabilities have been addressed in the libpng component of IBM Cognos Metrics Manager Vulnerability Details CVEID: CVE-2015-8126 DESCRIPTION: libpng is vulnerable to a buffer overflow, caused by improper bounds checking by the pngsetPLTE and pnggetPLTE functions. By persuading a...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos Metrics Manager (CVE-2015-2625 , CVE-2015-4748, CVE-2015-4749)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 6 Service Refresh 16 Fix Pack 5 and earlier and 7 Service Refresh 9 Fix Pack 1 and earlier that is used by IBM Cognos Metrics Manager. These issues were disclosed as part of the IBM Java SDK...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos Metrics Manager (CVE-2015-0478, CVE-2015-0488, CVE-2015-2808)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 6 and 7 that are used by IBM Cognos Metrics Manager. These issues were disclosed as part of the IBM Java SDK updates in April 2015. This bulletin also addresses RC4 Bar Mitzvah Attack for...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Cognos Metrics Manager (CVE-2015-0286, CVE-2015-0287, CVE-2015-0288, CVE-2015-0289, CVE-2015-0293)

Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL is used by IBM Cognos Metrics Manager. IBM Cognos Metrics Manager has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-0286 DESCRIPTION: OpenSSL is vulnerable to a denial of servic...

Security Bulletin: TLS padding vulnerability affects IBM Cognos Metrics Manager (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM Cognos Metrics Manager Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain sensitive information,...

Security Bulletin: A vulnerability in Apache Axis affects IBM Cognos Metrics Manager (CVE-2012-5784)

Summary An Apache Axis vulnerability was disclosed in Nov 2012. The Apache Axis library is included with IBM Cognos Metrics Manager. IBM Cognos Metrics Manager has addressed the vulnerability. Vulnerability Details CVEID: CVE-2012-5784 DESCRIPTION: Apache Axis 1.4, as used in multiple products,...

Security Bulletin: Vulnerability in SSLv3 affects IBM Cognos Metrics Manager (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Cognos Metrics Manager. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...