Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with Rational ClearQuest (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of IBM Rational ClearQuest CQ. Information about security vulnerabilities affecting IBM DB2 has been published in a security bulletin. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Foll...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM B2B Advanced Communications (CVE-2015-0138, CVE-2014-6593, CVE-2015-0410)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 SR8 that is used by IBM B2B Advanced Communications. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses the “FREAK: Factoring Attack on RSA-EXPORT...

Security Bulletin: Security vulnerabilities have been identified in IBM® DB2® shipped with IBM InfoSphere Information Server and IBM InfoSphere DataClick (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of IBM InfoSphere Information Server and IBM InfoSphere Data Click. Information about security vulnerabilities affecting IBM DB2 has been published in a security bulletin. Vulnerability Details Please consult the security bulletin IBM DB2 is impacted by...

Security Bulletin: Vulnerability in OpenSSL affects IBM® DB2® LUW (CVE-2015-0204)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by IBM DB2 LUW. IBM DB2 LUW has addressed the applicable CVEs. Vulnerability Details CVEID:...

Security Bulletin: Vulnerability in RC4 stream cipher in IBM SDK Java Technology Edition, Versions 1.6 and 1.7 affects IBM SPSS Collaboration and Deployment Services (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM SPSS Collaboration and Deployment Services. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An...

Security Bulletin: Multiple vulnerabilities affect IBM InfoSphere Information Server (CVE-2015-0383, CVE-2015-0410, CVE-2014-6593 CVE-2015-0138 CVE-2015-2808)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 6 and 7 that are used by IBM InfoSphere Information Server. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses the “FREAK: Factoring Attack on...

Security Bulletin: IBM® DB2® is impacted by multiple TLS/SSL security vulnerabilities (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 for Linux, Unix and Windows is affected by multiple problems related to the SSL implementation, which, under very specific conditions, can cause DB2 server to become unresponsive, hang or crash. By default, DB2 does not use TLS/SSL for client-server communication and therefore,...

Security Bulletin: Vulnerability in IBM® Runtime Environment Java™ Technology Edition affects IBM Cognos Business Intelligence Server (CVE-2015-0138)

Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects IBM® Runtime Environment Java™ Technology Edition, Versions 6 and 7 that is used by IBM Cognos Business Intelligence Server. Vulnerability Details CVEID: CVE-2015-0138 DESCRIPTION: A...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Algo Credit Limits (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM Algo Credit Limits. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly...

Security Bulletin: Vulnerabilities in OpenSSL affect Cognos Insight (CVE-2015-0204)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by Cognos Insight. Cognos Insight has addressed the applicable CVEs. Vulnerability Details...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 and IBM SPSS Modeler shipped with IBM Predictive Maintenance and Quality (CVE-2014-0963, CVE-2013-0647)

Summary IBM DB2 and IBM SPSS Modeler are shipped as components of IBM Predictive Maintenance and Quality. Information about security vulnerabilities affecting IBM DB2 and IBM SPSS Modeler has been published in security bulletins. Vulnerability Details Please consult the security bulletin IBM DB2 ...

Security Bulletin: Vulnerability in IBM Java Runtimes affect Websphere Business Modeler Advanced and Websphere Business Modeler Basic (CVE-2015-0138)

Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects IBM® Runtime Environments Java™ Technology Edition, Version 6.0.5 that is used by WebSphere Business Modeler Advanced and WebSphere Business Modeler Basic. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Integration Designer (IID) and WebSphere Integration Developer (WID)(CVE-2015-0138, CVE-2015-0410, CVE-2014-6593)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 1.6 and 1.7 that is used by IBM Integration Designer IID and WebSphere Integration Developer WID. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere DataPower XC10 Appliance: CVE-2015-0138, CVE-2014-6593, CVE-2015-0410

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition. These vulnerabilities affect WebSphere DataPower XC10 versions 2.1 and 2.5. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses the “FREAK:...

Security Bulletin: Vulnerability in IBM Java runtime affects WebSphere Service Registry and Repository (CVE-2015-0138)

Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability may affect some configurations of WebSphere Application Server used by WebSphere Service Registry and Repository. Vulnerability Details CVEID: CVE-2015-0138 DESCRIPTION: A vulnerability in various IBM...

Security Bulletin: FREAK vulnerability in TLS/SSL affects IBM CICS Transaction Gateway (CVE-2015-0204)

Summary A vulnerability in the OpenSSL ssl3getkeyexchange function could allow a remote downgrade the security of certain TLS connections. An OpenSSL client accepts the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. This could allow a remote attacker using a...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with WebSphere Remote server (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of WebSphere Remote Server. Information about security vulnerabilities affecting IBM DB2 has been published in a security bulletin. Vulnerability Details For vulnerability details, see the IBM DB2 is impacted by multiple TLS/SSL security vulnerabilities...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with IBM Business Monitor (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of IBM Business Monitor. Information about security vulnerabilities affecting IBM DB2 has been published in a security bulletin. Vulnerability Details For vulnerability details, see the IBM DB2 is impacted by multiple TLS/SSL security vulnerabilities...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with WebSphere Enterprise Service Bus (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of WebSphere Enterprise Service Bus. Information about security vulnerabilities that affect IBM DB2 have been published in a security bulletin Vulnerability Details Consult the security bulletin IBM DB2 is impacted by multiple TLS/SSL security...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with WebSphere Enterprise Service Bus Registry Edition (CVE-2013-6747, CVE-2014-0963)

Summary IBM DB2 is shipped as a component of WebSphere Enterprise Service Bus Registry Edition. Information about security vulnerabilities that affect IBM DB2 have been published in a security bulletin Vulnerability Details Consult the security bulletin IBM DB2 is impacted by multiple TLS/SSL...