Security Bulletin: Multiple vulnerabilities in scala-compiler-2.11.8.jar affect IBM Application Performance Management products

Summary There are multiple vulnerabilities in scala-compiler-2.11.8.jar used by IBM Application Performance Management. IBM Application Performance Management has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2017-15288 DESCRIPTION: Scala could allow a local authenticated attacke...

High severity vulnerability that affects org.scala-lang:scala-compiler

The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/$USER:shared/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges...

ai.grakn:client-java (1.3.0), ai.grakn:grakn-bootup (>=v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, <=1.2.0) +3852 more potentially affected by CVE-2017-15288 via org.scala-lang:scala-compiler (>=2.6.1-rc1, <=2.10.6)

org.scala-lang:scala-compiler MAVEN version =2.6.1-rc1, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...

GHSA-QVXV-PMQ9-4Q7G High severity vulnerability that affects org.scala-lang:scala-compiler

The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/$USER:shared/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges...

ae.teletronics.nlp:entityextraction (1.3), ai.catboost:catboost-spark_2.3_2.11 (>=0.25, <=1.2.7) +3609 more potentially affected by CVE-2017-15288 via org.scala-lang:scala-compiler (>=2.11.0, <=2.11.11)

org.scala-lang:scala-compiler MAVEN version =2.11.0, =0.25, =0.42.1, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.4.1, =2.0.0, =3.34.0.3-1-2.2, =2.0.0, =2.0.0, =2.0.18, =2.0.0, =2.2.10 and more Source cves: CVE-2017-15288 Source advisory: MEND:CVE-2017-15288...

Arbitrary Code Execution

scala-compiler is vulnerable to arbitrary code execution. A malicious user can write and execute arbitrary scala class files on the system through the compiler daemon due to weak permissions for private files in /tmp/scala-devel/$USER:shared/scalac-compile-server-port...