Security Bulletin: Multiple vulnerabilities in IBM Java affect IBM SPSS Modeler (CVE-2016-0466, CVE-2015-7575, CVE-2016-0475)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 Service Refresh 16 Fix Pack 15, IBM SDK, Java Technology Edition, Version 7 Service Refresh 9 Fix Pack 20, IBM SDK, Java Technology Edition, Version 7R1 Service Refresh 3 Fix Pack 20 that are used by IBM SP...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM SPSS Analytic Server (CVE-2015-4872, CVE-2015-4734 , CVE-2015-5006, CVE-2015-7575)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 1.6 and 1.7 that is used by IBM SPSS Analytic Server. These issues were disclosed as part of the IBM Java SDK updates in October 2015 and includes the vulnerability commonly referred to as...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM SPSS Statistics (CVE-2015-4872, CVE-2015-4734, CVE-2015-5006, CVE-2015-7575)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 1.6 and 1.7 that is used by IBM SPSS Statistics. These issues were disclosed as part of the IBM Java SDK updates in October 2015 and includes the vulnerability commonly referred to as “SLOTH”...

Security Bulletin: SLOTH - Weak MD5 Signature Hash vulnerability in IBM Java SDK affect IBM SPSS Collaboration and Deployment Services (CVE-2015-7575)

Summary SLOTH - Weak MD5 Signature Hash vulnerability in IBM Java SDK affect IBM SPSS Collaboration and Deployment Services CVE-2015-7575 Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the...

Security Bulletin: Memory dump from Modeler executables contains cleartext strings (CVE-2015-4991)

Summary IBM SPSS Modeler store plain text data in memory dumps, which could allow a local attacker to obtain information to aid in further attacks against the system. Vulnerability Details CVEID: CVE-2015-4991 DESCRIPTION: IBM SPSS Modeler store plain text data in memory dumps, which could allow ...

Security Bulletin: Vulnerability in Apache Commons affects IBM SPSS Modeler (CVE-2015-7450)

Summary Apache Commons Collections could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of data with Java InvokerTransformer class. By sending specially crafted data, an attacker could exploit this vulnerability to execute arbitrary Java code on the...

Security Bulletin: Multiple vulnerabilities in bundled components affects IBM SPSS Analytic Server (CVE-2015-7450).

Summary An Apache Commons Collections vulnerability in handling Java object deserialization was addressed by IBM SPSS Analytic Server. An updated IBM WebSphere Liberty run time is shipped to address a security vulnerability in IBM SPSS Analytic Server. Vulnerability Details CVEID: CVE-2015-7450...

Security Bulletin: Multiple vulnerabilities in bundled components affects IBM SPSS Collaboration and Deployment Services (CVE-2015-7450).

Summary An Apache Commons Collections vulnerability in handling Java object deserialization was addressed by IBM SPSS Collaboration and Deployment Services. This vulnerability affects all versions of IBM SPSS Collaboration and Deployment Services. An updated IBM WebSphere Liberty runtime is shipp...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM SPSS Modeler (CVE-2015-2625, CVE-2015-1931, CVE-2015-2613, CVE-2015-2601)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version Version 6 Service Refresh 16 Fix Pack 5, IBM SDK, Java Technology Edition, Version 7 Service Refresh 9 Fix Pack 1, IBM SDK, Java Technology Edition, Version 7R1 Service Refresh 3 Fix Pack 1 that are used by I...

Security Bulletin: Vulnerability in GSKit affect IBM SPSS Modeler (CVE-2015-1788)

Summary GSKit is an internal component used by IBM SPSS Modeler. The GSKit contains a security vulnerability which may cause infinite loop. The issue is identified by the specified CVE below. Vulnerability Details CVEID: CVE-2015-1788 DESCRIPTION: OpenSSL is vulnerable to a denial of service,...

Security Bulletin: DH Key Exchange protocol vulnerability (“Logjam”) affects SPSS Data Access Pack

Summary TLS connections using Diffie-Hellman DH key exchange protocol affects IBM SPSS Data Accesss Pack 7.1.1. This attack has been referred to as "Logjam" in various sources. IBM SPSS Data Access Pack is a software component used by IBM SPSS Statistics and IBM SPSS Modeler. Vulnerability Detail...

Security Bulletin: DH key exchange protocol vulnerability (“Logjam”) in IBM Java SDK affects IBM SPSS Statistics (CVE-2015-4000)

Summary TLS connections using Diffie-Hellman DH key exchange protocol, “Logjam” attack, affects IBM Java SDK 1.6, 1.7 that is used by IBM SPSS Statistics. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused...

Security Bulletin: Multiple vulnerabilities in IBM SPSS Modeler (CVE-2013-6739, CVE-2013-5372, CVE-2013-5825)

Summary Vulnerabilities have been identified in IBM SPSS Modeler which make the product vulnerable to an incorrect Single Sign On being accepted on UNIX and a denial of service attack triggered by a malicious XML data. Vulnerability Details VULNERABILITY DETAILS: CVEID: CVE-2013-6739 DESCRIPTION:...

Security Bulletin: User sessions running with root GID in IBM SPSS Modeler (CVE-2014-3038)

Summary IBM SPSS Modeler running on Unix platforms contains a vulnerability that could allow a local attacker to gain access to files that normally would only be available to privileged users. The server authenticates a user and spawns a new process that runs in the context of the authenticated...

Security Bulletin: IBM SPSS Modeler CPU utilization (CVE-2014-0963)

Summary IBM SPSS Modeler is affected by a problem related to the SSL implementation which, under very specific conditions, can cause CPU utilization to rapidly increase. Vulnerability Details CVE ID: CVE-2014-0963 DESCRIPTION: IBM SPSS Modeler Server is affected by a problem with the handling of...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM SPSS Modeler (CVE-2015-0138, CVE-2015-0383, CVE-2015-0410, CVE-2014-6593)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 6.0.15, 7.1.2, 7.0.8 that is used by IBM SPSS Modeler. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses the “FREAK: Factoring Attack on RSA-EXPORT...

Security Bulletin: TLS padding vulnerability affects IBM SPSS Modeler (CVE-2014-8730)

Summary Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM SPSS Modeler. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain sensitive information, caus...

Security Bulletin: Vulnerability in SSLv3 affects IBM SPSS Modeler (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM SPSS Modeler. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive informatio...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM SPSS Modeler (CVE-2015-4000, CVE-2015-0478, CVE-2015-0488)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 6 Service Refresh 16 Fix Pack 3, IBM SDK Java Technology Edition, Version 7 Service Refresh 8 Fix Pack 10, and IBM SDK Java Technology Edition, Version 7R1 Service Refresh 2 Fix Pack 10 that are used by IBM SPS...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM SPSS Collaboration and Deployment Services (CVE-2015-0478, CVE-2015-0488, CVE-2015-2808, CVE-2015-4000)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Versions 1.6 and 1.7 that are used by IBM SPSS Collaboration and Deployment Services. These issues were disclosed as part of the IBM Java SDK updates in April 2015 and IBM Java SDK update addressing TLS protocol...