188 matches found
Security Bulletin: Vulnerabilities in OpenSSL (CVE-2014-3508 and CVE-2014-3509) affect the virtual machines deployed by IBM PureApplication System.
Summary Nine OpenSSL vulnerabilities were disclosed in August 2014. This bulletin addresses the two vulnerabilities that are applicable to virtual machines which are deployed by IBM PureApplication System using the IBM OS Image for Red Hat Linux Systems and the IBM OS Image for AIX Systems...
Security Bulletin: TLS padding vulnerability affects IBM PureApplication System (CVE-2014-8730)
Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM PureApplication System. Vulnerability Details CVEID: CVE-2014-8730 DESCRIPTION: IBM PureApplication Server bundles IBM HTTP Server, which could allow a...
Security Bulletin: Vulnerabilities in OpenSSL affects IBM PureApplication System (CVE-2015-0209, CVE-2015-0286, CVE-2015-0287, CVE-2015-0288, CVE-2015-0289, CVE-2015-0292, and CVE-2015-0293)
Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL is used by IBM PureApplication System. IBM PureApplication System has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-0209 DESCRIPTION: OpenSSL could allow a remote attacker to...
Security Bulletin: Venom vulnerability affects IBM PureApplication System (CVE-2015-3456)
Summary IBM PureApplication System is vulnerable to Venom: "Virtualized Environment Neglected Operation Manipulation". Vulnerability Details CVEID: CVE-2015-3456 DESCRIPTION: QEMU is vulnerable to a buffer overflow, caused by improper bounds checking by the Floppy Disk Controller FDC emulation. B...
Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Image Construction and Composition Tool (CVE-2014-3566 and CVE-2014-6457)
Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 that is used by IBM PureApplication System. This also includes a fix for the Padding Oracle On Downgraded Legacy Encryption POODLE SSLv3 vulnerability CVE-2014-3566. These were disclosed as part of the IBM...
Security Bulletin: Vulnerability in RC4 stream cipher affects IBM PureApplication System (CVE-2015-2808)
Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM PureApplication System. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit th...
Security Bulletin: Vulnerability in IBM Java SDK affects IBM OS Images for Red Hat Linux Systems, AIX, and Windows. (CVE-2015-0138)
Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects IBM SDK Java Technology Edition, Version 6 and IBM SDK Java Technology Edition, Version 7 that is used by IBM OS Images for Red Hat Linux Systems, AIX, and Windows. Vulnerability Details CVEID...
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server Hypervisor Edition shipped with IBM PureApplication System (CVE-2015-0138)
Summary IBM WebSphere Application Server is shipped as a component of IBM PureApplication System. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin:...
Security Bulletin: Vulnerabilities in OpenSSL affect IBM PureApplication System (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568)
Summary OpenSSL vulnerabilities along with SSL 3 Fallback protection TLSFALLBACKSCSV were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by IBM PureApplication System. IBM PureApplication System has addressed the applicable CVEs and included the SSL 3.0 Fallback protection...
Security Bulletin: Log viewer vulnerability affects IBM PureApplication System (CVE-2014-6190)
Summary Log viewer vulnerability affects IBM PureApplication System. Vulnerability Details CVEID: CVE-2014-6190 DESCRIPTION: Defined system users without proper permissions can access the log viewer functionality by entering the log page URLs in their browser. CVSS Base Score: 5.0 CVSS Temporal...
Security Bulletin: A security vulnerability has been identified in IBM Tivoli Directory Server and IBM Security Directory Server shipped with IBM PureApplication System. (CVE-2015-0138)
Summary IBM Tivoli Directory Server and IBM Security Directory Server are shipped as a component of IBM PureApplication System. Information about a security vulnerability affecting IBM Tivoli Directory Server and IBM Security Directory Server has been published in a security bulletin. Vulnerabili...
Security Bulletin: Vulnerability in SSLv3 affects IBM PureApplication System (CVE-2014-3566)
Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM PureApplication System. Vulnerability Details CVEID: CVE-2014-3566 DESCRIPTION: The product might allow a remote attacker to obtain sensiti...
Security Bulletin: GNU C library (glibc) vulnerability affects IBM PureApplication System (CVE-2015-0235)
Summary GNU C library glibc vulnerability that has been referred to as GHOST affects IBM PureApplication System. Vulnerability Details CVEID: CVE-2015-0235 DESCRIPTION: The gethostbyname functions of the GNU C Library glibc are vulnerable to a buffer overflow. By sending a specially crafted, but...
Security Bulletin: A security vulnerability has been identified in IBM HTTP Server shipped with IBM PureApplication System (CVE-2014-8730)
Summary IBM HTTP Server is shipped as a component that can be deployed as part of a virtual application pattern or virtual system. Information about a security vulnerability affecting IBM HTTP Server has been published in a security bulletin. Vulnerability Details Consult the following security...
Security Bulletin: File path traversal vulnerabilities affect IBM PureApplication System (CVE-2014-6158)
Summary File upload functionality within IBM PureApplication System might lead to server compromise and Denial of Service DoS. Vulnerability Details CVEID: CVE-2014-6158 DESCRIPTION: IBM PureApplication System’s file upload functions might lead to server compromise and DoS when authorized users...
Security Bulletin: Vulnerabilities in Bash affect IBM PureApplication System (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)
Summary Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory corruption vulnerabilities. Bash is used by IBM PureApplication System. Vulnerability Details CVE-ID: CVE-2014-627...
Security vulnerability found in IBM WebSphere Application Server shipped with IBM PureApplication System (CVE-2014-0114)
Abstract Information about a security vulnerability affecting IBM WebSphere Application Server shipped as a component of IBM PureApplication System has been published in a security bulletin. Content IBM WebSphere Application Server is shipped as a component of IBM PureApplication System...
IBM PureApplication System Information Disclosure Vulnerability
IBM PureApplication System is a platform system designed for transactional Web and database applications. An information disclosure vulnerability exists in IBM PureApplication System, which allows remote attackers to bypass privilege checks and read sensitive information...
CVE-2014-6158
Multiple directory traversal vulnerabilities in the file-upload feature in IBM PureApplication System 1.0 before 1.0.0.4 iFix 10, 1.1 before 1.1.0.5, and 2.0 before 2.0.0.1 and Workload Deployer 3.1.0.7 before IF5 allow remote authenticated users to execute arbitrary code via a 1 Script Package, ...
Directory traversal
Multiple directory traversal vulnerabilities in the file-upload feature in IBM PureApplication System 1.0 before 1.0.0.4 iFix 10, 1.1 before 1.1.0.5, and 2.0 before 2.0.0.1 and Workload Deployer 3.1.0.7 before IF5 allow remote authenticated users to execute arbitrary code via a 1 Script Package, ...