Security Bulletin: SBB0002796

Summary Steps to update Java - QMF Workstation & QMF Vision Vulnerability Details CVEID: CVE-2019-4732 DESCRIPTION: IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute...

SUSE SLES12 Security Update : java-11-openjdk (SUSE-SU-2020:2008-1)

This update for java-11-openjdk fixes the following issues : Update to upstream tag jdk-11.0.8+10 July 2020 CPU, bsc1174157 - Security fixes : + JDK-8230613: Better ASCII conversions + JDK-8231800: Better listing of arrays + JDK-8232014: Expand DTD support + JDK-8233234: Better Zip Naming +...

Security Bulletin: InfoSphere BigInsights affected by vulnerabilities in IBM SDK Java™ Technology Edition (CVE-2013-4002, CVE-2013-5780)

Summary InfoSphere BigInsights is vulnerable to two vulnerabilities in IBM SDK Java Technology Edition. Vulnerability Details CVE-2013-4002 DESCRIPTION: A denial of service vulnerability in the Apache Xerces-J parser used by IBM SDK Java Technology Edition could result in a complete availability...

java-11-openjdk security update

1:11.0.8.10-0.0.1 - link atomic for ix86 build 1:11.0.8.10-0 - Update to shenandoah-jdk-11.0.8+10 GA - Switch to GA mode for final release. - Update release notes with last minute fix JDK-8248505. - This tarball is embargoed until 2020-07-14 @ 1pm PT. - Resolves: rhbz1838811 1:11.0.8.9-0.0.ea -...

java-1.8.0-openjdk security update

1:1.8.0.262.b10-0 - Update to aarch64-shenandoah-jdk8u262-b10. - Switch to GA mode for final release. - Update release notes for 8u262 release. - Fix typo in jfrarches which leads to ppc64 being wrongly excluded. - Split JDK-8042159 patch into per-repo patches as upstream. - Update JDK-8042159 JD...

java-11-openjdk security and enhancement update

1:11.0.8.10-0 - Update to shenandoah-jdk-11.0.8+10 GA - Switch to GA mode for final release. - Update release notes with last minute fix JDK-8248505. - This tarball is embargoed until 2020-07-14 @ 1pm PT. - Resolves: rhbz1838811 1:11.0.8.9-0.0.ea - Update to shenandoah-jdk-11.0.8+9 EA - Update...

Security Bulletin: IBM Kenexa LMS On Premise - CVE-2019-2949 (deferred from Oracle Oct 2019 CPU)

Summary We have identified that the IBM Kenexa LMS On Premise is affected by one or more security vulnerabilities. These have been addressed in LMS 6.1.0 version. Vulnerability Details CVEID: CVE-2019-2949 DESCRIPTION: An unspecified vulnerability in Java SE related to the Kerberos component coul...

Security Bulletin: IBM Kenexa LCMS Premier On Premise - CVE-2019-2949 (deferred from Oracle Oct 2019 CPU)

Summary We have identified that the IBM Kenexa LCMS Premier is affected by one or more security vulnerabilities. These have been addressed in LCMS Premier 14.0 version. Vulnerability Details CVEID: CVE-2019-2949 DESCRIPTION: An unspecified vulnerability in Java SE related to the Kerberos componen...

Security Bulletin: IBM Kenexa LCMS Premier On Premise - CVE-2020-2654 (deferred from Oracle Jan 2020 CPU)

Summary We have identified that the IBM Kenexa LCMS Premier is affected by one or more security vulnerabilities. These have been addressed in LCMS Premier 14.0 version. Vulnerability Details CVEID: CVE-2020-2654 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Libraries...

Denial of service in Apache Xerces2

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service infinite loop and application hang via malformed XML input, as...

CVE-2020-11975

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process...

Security Bulletin: IBM Kenexa LMS On Premise - IBM SDK, Java Technology Edition Quarterly CPU - Jan 2020 - Includes Oracle Jan 2020 CPU (CVE-2019-4732)

Summary We have identified that the IBM Kenexa LMS On Premise is affected by one or more security vulnerabilities. These have been addressed in LMS 6.1.0 version. Vulnerability Details CVEID: CVE-2019-4732 DESCRIPTION: IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0...

Fedora 30 : 1:java-1.8.0-openjdk (2020-21ca991b3b)

Update to OpenJDK 8u252 April Critical Patch Update - JDK-8223898, CVE-2020-2754: Forward references to Nashorn - JDK-8223904, CVE-2020-2755: Improve Nashorn matching - JDK-8224541, CVE-2020-2756: Better mapping of serial ENUMs - JDK-8224549, CVE-2020-2757: Less Blocking Array Queues - JDK-822560...

java-11-openjdk security update

1:11.0.7.10-4.0.1 - link atomic for ix86 build 1:11.0.7.10-4 - Add JDK-8228407 backport to resolve crashes during verification. - Resolves: rhbz1810557 1:11.0.7.10-3 - Amend release notes, removing issue actually fixed in 11.0.6. - Resolves: rhbz1810557 1:11.0.7.10-2 - Add release notes. -...

CVE-2020-2801

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to...

Code injection

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to...

CVE-2020-2801

CVE-2020-2801 affects Oracle WebLogic Server (Core) across 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. The vulnerability allows an unauthenticated attacker with network access via IIOP or T3 to take over the WebLogic Server. The issue’s patch addresses the vulnerability only if the WLS ins...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM® Db2®. (January 2020 CPU)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7.0.10.55 and earlier, 7.1.4.55 and earlier, 8.0.6.0 and earlier used by IBM® Db2®. These issues were disclosed as part of the IBM Java SDK updates in Jan 2020. Vulnerability Details CVEID: CVE-2020-2593...

Gadgetinspector - A Byte Code Analyzer For Finding Deserialization Gadget Chains In Java Applications

This project inspects Java libraries and classpaths for gadget chains. Gadgets chains are used to construct exploits for deserialization vulnerabilities. By automatically discovering possible gadgets chains in an application's classpath penetration testers can quickly construct exploits and...

Startup issues for both IBM Sterling B2B Integrator and IBM Sterling File Gateway caused by Microsoft® Windows Patch KB2992611 for Microsoft® Security Bulletin MS14-066

Abstract Applying Windows Patch KB2992611 for Microsoft® Security Bulletin MS14-066 could prevent startup of both IBM Sterling B2B Integrator and IBM Sterling File Gateway. Content IBM Support has received several production down calls from IBM Sterling B2B Integrator and IBM Sterling File Gatewa...