Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple vulnerabilities due to IBM Java Runtime

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8 used by IBM Sterling External Authentication Server. IBM Sterling External Authentication Server has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-21628 DESCRIPTION: Java SE is vulnerabl...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple vulnerabilities due to IBM Java Runtime

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8 used by IBM Sterling Secure Proxy. IBM Sterling Secure Proxy has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-21426 DESCRIPTION: An unspecified vulnerability in Java SE related to the...

Security Bulletin: IBM Content Manager Enterprise Edition is affected by a vulnerability in Eclipse Openj9

Summary There is a vulnerability in Eclipse Openj9 used by IBM Content Manager Enterprise Edition. IBM Content Manager Enterprise Edition has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security...

Security Bulletin: CVE-2022-3676 may affect IBM® SDK, Java™ Technology Edition

Summary CVE-2022-3676 was addressed in Eclipse OpenJ9 version 0.35 Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security restrictions, caused by improper runtime type check by the interface calls. By sending a specially-crafted...

CVE-2023-21968 vulnerabilities

Vulnerabilities for packages: openjdk-17-openj9, openjdk, openjdk-25-openj9, openjdk-8-openj9, openjdk-26-openj9, openjdk-21-openj9, openjdk-11-openj9...

CVE-2023-21967 vulnerabilities

Vulnerabilities for packages: openjdk-17-openj9, openjdk, openjdk-25-openj9, openjdk-8-openj9, openjdk-26-openj9, openjdk-21-openj9, openjdk-11-openj9...

CVE-2023-21954 vulnerabilities

Vulnerabilities for packages: openjdk-17-openj9, openjdk, openjdk-25-openj9, openjdk-8-openj9, openjdk-26-openj9, openjdk-21-openj9, openjdk-11-openj9...

CVE-2023-21937 vulnerabilities

Vulnerabilities for packages: openjdk-17-openj9, openjdk, openjdk-25-openj9, openjdk-8-openj9, openjdk-26-openj9, openjdk-21-openj9, openjdk-11-openj9...

CVE-2023-21938 vulnerabilities

Vulnerabilities for packages: openjdk-17-openj9, openjdk, openjdk-25-openj9, openjdk-8-openj9, openjdk-26-openj9, openjdk-21-openj9, openjdk-11-openj9...

CVE-2023-21939 vulnerabilities

Vulnerabilities for packages: openjdk-17-openj9, openjdk, openjdk-25-openj9, openjdk-8-openj9, openjdk-26-openj9, openjdk-21-openj9, openjdk-11-openj9...

Security Bulletin: The IBM® Engineering Lifecycle Engineering product using IBM Java - Eclipse OpenJ9 is vulnerable to CVE-2022-3676

Summary A flaw in Eclipse OpenJ9 leads to type confusion under certain circumstances, which can be exploited to access or modify memory. This may allow malicious untrusted code to elevate its privileges. Following IBM® Engineering Lifecycle Engineering product is vulnerable to this attack, it has...

Security Bulletin: IBM Security Verify Governance is vulnerable to remote security bypass (CVE-2022-3676)

Summary IBM Security Verify Governance is vulnerable to a security bypass due to use of Eclipse Openj9. IBM Security Verify Governance has addressed the issue by upgrading the vulnerable component. Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products

Summary Multiple vulnerabilities in the IBM® Runtime Environment Java™ Technology Edition affect IBM SAN Volume Controller, IBM Storwize V7000, V5000, V3700 and V3500, IBM Spectrum Virtualize Software, IBM Spectrum Virtualize for Public Cloud and IBM FlashSystem V9000 and 9100 family products. Th...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Oct 2022 - Includes Oracle October 2022 CPU and IBM Java - OpenJ9 CVE-2022-3676

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 8 that are used by Rational Software Architect Designer and Rational Software Architect Designer for Websphere Software. These issues were disclosed as part of the IBM Java SDK updates in Oct 2022 and IBM Ja...

Security Bulletin: Multiple vulnerabilities in IBM Semeru Runtime affect z/Transaction Processing Facility

Summary There are multiple vulnerabilities in IBM® Semeru Runtime Certified Edition 11 that is used by the z/TPF system. z/TPF has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-21628 DESCRIPTION: Java SE is vulnerable to a denial of service, caused by a flaw in the Lightweig...

Security Bulletin: CVE-2022-3676 may affect IBM CICS TX Standard

Summary Eclipse Openj9 with IBM Java could allow a remote attacker to bypass security restrictions, caused by improper runtime type check by the interface calls. By sending a specially-crafted request using bytecode, an attacker could exploit this vulnerability to access or modify memory. This...

SUSE CVE-2018-12539

In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on...

SUSE CVE-2018-12549

In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it...

SUSE CVE-2018-12547

In Eclipse OpenJ9, prior to the 0.12.0 release, the jiosnprintf and jiovsnprintf native methods ignored the length parameter. This affects existing APIs that called the functions to exceed the allocated buffer. This functions were not directly callable by non-native user code...

SUSE CVE-2019-10245

In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load...