Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server January 2020 CPU

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These might affect some configurations of IBM WebSphere Application Server Traditional, IBM WebSphere Application Server Liberty and IBM WebSphere Applicatio...

Security Bulletin: Aspera Web Application (Faspex, Console, Orchestrator, Shares) are affected by Apache vulnerabilities (CVE-2019-9517, CVE-2019-10097)

Summary Aspera Web Application Faspex, Console, Shares, Orchestrator have affected the following Apache vulnerabilities. Vulnerability Details CVEID: CVE-2019-9517 DESCRIPTION: Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of...

Security Bulletin: Rational Asset Analyzer (RAA) is affected by several WebSphere Application Server vulnerabilities.

Summary Rational Asset Analyzer RAA has addressed the following WebSphere Application Server vulnerabilities. Vulnerability Details CVEID: CVE-2019-9515 DESCRIPTION: Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM i

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM i. Vulnerability Details CVEID: CVE-2015-2638 DESCRIPTION: An unspecified vulnerability related to the 2D component has complete confidentiality impact, complete integrity impact, and complete...

Security Bulletin: Vulnerabilities in OpenSSH affect IBM i (CVE-2016-1907, CVE-2016-1908, CVE-2016-3115)

Summary OpenSSH vulnerabilities affect IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-3115 DESCRIPTION: OpenSSH could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied X11...

Security Bulletin: IBM i is affected by a vulnerability in OpenSSH (CVE-2018-15473)

Summary OpenSSH is used by IBM i. IBM i has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2018-15473 DESCRIPTION: OpenSSH could allow a remote attacker to obtain sensitive information, caused by different responses to valid and invalid authentication attempts. By sending a...

Security Bulletin: Multiple vulnerabilities in Java affect IBM Spectrum Protect Plus

Summary Multiple vulnerabilities in Java were disclosed as part of the Java SDK updates in January 2019 that affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2018-1890 DESCRIPTION: IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may...

Security Bulletin: Open Source Libvorbis, Patch and Python-paramiko vulnerabilities affect IBM Netezza Host Management

Summary Open Source Libvorbis Patch and Python-paramiko is used by IBM Netezza Host Management. IBM Netezza Host Management has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-7750 DESCRIPTION: Paramiko could allow a remote attacker to bypass security restrictions, caused by...

Security Bulletin: IBM Cloud Private for Data is affected by an issue with runc used by Docker

Summary IBM Cloud Private for Data is affected by an issue with runc used by Docker. The vulnerability allows a malicious container to overwrite the host runc binary and thus gain root-level code execution on the host. Vulnerability Details CVEID: CVE-2019-5736 DESCRIPTION: Runc could allow a loc...

Security Bulletin: Security Vulnerabilties have been addressed in IBM Cognos Analytics

Summary Security vulnerabilities that affect ICU, that is embedded in IBM Cognos Analytics, have been addressed. Cognos Analytics consumes Bootstrap and Jcraft Jsch. The versions of these components have been upgraded to addressed known vulnerabilities. A vulnerability has been addressed in which...

Security Bulletin: IBM Cloud Kubernetes Service is affected by Kubernetes security vulnerabilities (CVE-2019-9512, CVE-2019-9514)

Summary IBM Cloud Kubernetes Service is affected by security vulnerabilities in the net/http library of the Go language that affects all Kubernetes components. These vulnerabilities can result in a denial-of-service attack against a process with an HTTP or HTTPS listener CVE-2019-9512 and...

Security Bulletin: IBM Security Privileged Identity Manager is affected by multiple security vulnerabilities

Summary IBM Security Privileged Identity Manager has addressed the following security vulnerabilities. Vulnerability Details CVEID: CVE-2012-6708 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the jQuerystrInput function. A remot...

Security Bulletin: Multiple vulnerabilities in glibc affect IBM MQ Appliance

Summary Vulnerabilities in glibc affect the IBM MQ Appliance. IBM MQ Appliance has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-8778 DESCRIPTION: GNU C Library glibc could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities (CVE-2019-3855, CVE-2019-3856, CVE-2019-3857, CVE-2019-3863)

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to address multiple security vulnerabilities. The libssh2 packages that implement the SSH2 protocol is affected by four vulnerabilities. Vulnerability Details CVEID: CVE-2019-3855 DESCRIPTION...

Security Bulletin: A vulnerability in IBM Java SDK and IBM Java Runtime affect Rational Business Developer.

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 7 & 8 and IBM® Runtime Environment Java™ Version 7 & 8 used by Rational Business Developer. Rational Business Developer has addressed the applicable CVE. This issue was disclosed as part of the IBM Java SDK and Runtime...

Security Bulletin: IBM MessageSight/MessageGateway is affected by the following jQuery vulnerability

Summary IBM MessageSight/MessageGateway has addressed the following jQuery vulnerability: CVE-2019-11358: jQuery mishandles jQuery.extendtrue, , ... Vulnerability Details CVEID: CVE-2019-11358 DESCRIPTION: jQuery, as used in Drupal core, is vulnerable to cross-site scripting, caused by improper...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Datapower Gateway

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™, Versions 7.1-4 and 8.0-5 used by IBM DataPower Gateway. IBM DataPower Gateway has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-12547 DESCRIPTION: Eclipse OpenJ9 is vulnerable to a buffer overflow...

Security Bulletin: IBM QRadar Network Packet Capture is vulnerable to publicly disclosed vulnerabilities from OpenSSL (CVE-2018-0739, CVE-2018-0732)

Summary OpenSSL as used by IBM QRadar Network Packet Capture is vulnerable to a denial of service Vulnerability Details CVEID: CVE-2018-0739 Description: OpenSSL is vulnerable to a denial of service. By sending specially crafted ASN.1 data with a recursive definition, a remote attacker could...

Security Bulletin: IBM OpenPages GRC Platform is affected by Apache POI vulnerability (CVE-2017-12626)

Summary IBM OpenPages GRC Platform has addressed Apache POI vulnerability CVE-2017-12626 Vulnerability Details CVEID: CVE-2017-12626 DESCRIPTION: Apache POI is vulnerable to a denial of service, caused by an error while parsing malicious WMF, EMF, MSG and macros and specially crafted DOC, PPT and...

Security Bulletin: Vulnerabilities in Linux Kernel affect Intel® Manycore Platform Software Stack (Intel® MPSS) for Linux and Windows

Summary IntelR Manycore Platform Software Stack IntelR MPSS for Linux and Windows have addressed the following vulnerabilities in Linux Kernel. Vulnerability Details Summary Intel® Manycore Platform Software Stack Intel® MPSS for Linux and Windows have addressed the following vulnerabilities in...

Security Bulletin: Vulnerabilities in cURL affect IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru (CVE-2017-8816 CVE-2017-8817 CVE-2017-8818)

Summary IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru has addressed the following vulnerabilities in cURL. Vulnerability Details Summary IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru has addressed the following vulnerabilities in cURL. Vulnerability Details CVEID: CVE-2017-881...

Security Bulletin: Vulnerabilities in cURL/libcurl affect Intel® Manycore Platform Software Stack (Intel® MPSS) for Linux and Windows

Summary IntelR Manycore Platform Software Stack IntelR MPSS for Linux and Windows have addressed the following vulnerabilities in cURL/libcurl. Vulnerability Details Summary Intel® Manycore Platform Software Stack Intel® MPSS for Linux and Windows have addressed the following vulnerabilities in...

Security Bulletin: Vulnerabilities in libxml2 affect IBM Flex System Networking Switch products

Summary IBM Flex System Networking Switch products have addressed the following vulnerabilities in libxml2. Vulnerability Details Summary IBM Flex System Networking Switch products have addressed the following vulnerabilities in libxml2. Vulnerability Details: CVE-ID: CVE-2016-3627 Description:...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Flex System FC3171 8Gb SAN Switch & SAN Pass-thru Firmware (CVE-2016-2107 CVE-2016-2176)

Summary IBM Flex System FC3171 8Gb SAN Switch & SAN Pass-thru Firmware have addressed these OpenSSL vulnerabilities. Vulnerability Details Summary OpenSSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. OpenSSL is used by IBM Flex System FC3171 8Gb SAN Switch and SAN...

Security Bulletin: Potential MITM attack in Apache CXF used by WebSphere Application Server affects IBM Operations Analytics - Log Analysis (CVE-2018-8039)

Summary There is a potential man-in-the-middle attack in Apache CXF used by WebSphere Application Server CVE-2018-8039 Vulnerability Details CVEID: CVE-2018-8039 DESCRIPTION: Apache CXF could allow a remote attacker to conduct a man-in-the-middle attack. The TLS hostname verification does not wor...

Security Bulletin: Vulnerabilities in libjpeg affect IBM BladeCenter Advanced Management Module (AMM)

Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerabilities in libjpeg. Vulnerability Details CVEID: CVE-2018-11813 DESCRIPTION: libjpeg is vulnerable to a denial of service, caused by a large loop in the readpixel function in rdtarga.c. By persuading a vict...

Security Bulletin: Aspera OnDemand is affected by an openSSL vulnerability (CVE-2017-3736)

Summary Aspera OnDemand has addressed the following openSSL vulnerability. Vulnerability Details CVEID: CVE-2017-3736 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a carry propagation flaw in the x8664 Montgomery squaring function bnsqrx8xinternal. ...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Security Access Manager

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 6, 7 & 8 and IBM® Runtime Environment Java™ Versions 6,7 & 8 used by IBM Security Access Manager software and appliances. These issues were disclosed as part of the IBM Java SDK updates in January 2018...

Security Bulletin: Vulnerability in IBM Java Runtime affect Rational Host On-Demand (CVE-2015-7575)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 1.7SR6 that is used by IBM Rational Host On-Demand This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in the IBM SDK, Java Technology Edition affects IBM Performance Management products

Summary Multiple vulnerabilities in the Oracle Java SE and the Java SE Embedded impact the IBM SDK, Java Technology Edition. Vulnerability Details CVEID: CVE-2016-5542 DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the Libraries component has no...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Algo One - Core

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7.0.10.15 and earlier and 8.0.5.7 and earlier and IBM® Runtime Environment Java™ Version 7.0.10.15 and earlier and 8.0.5.7 and earlier used by IBM Algo One - Core. These issues were disclosed as part of the I...

Security Bulletin: Vulnerabilities in NTP affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in Network Time Protocol NTP. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2015-5194 DESCRIPTION: Network Time Protocol NTP is vulnerable to a denial of service, caused by an uninitialized variable when processing...

Security Bulletin: Samba vulnerability issue on IBM Storwize V7000 Unified

Summary IBM Storwize V7000 Unified is shipped with Samba, for which a fix is available for security vulnerabilities. Vulnerability Details Samba is used in IBM Storwize V7000 Unified to enable file management and authentication services for Microsoft Windows environments. CVEID: CVE-2017-7494...

Security Bulletin: Multiple Apache Tomcat vulnerabilities affect IBM SONAS.

Summary Multiple Apache Tomcat vulnerabilities affect IBM SONAS. Vulnerability Details This bulletin relates to vulnerabilities in the Apache Tomcat component which is used to provide the product’s management GUI. The CLI interface is unaffected. CVEID: CVE-2016-0762 DESCRIPTION: Apache Tomcat...

Security Bulletin: Multiple DB2 vulnerabilities affect IBM Spectrum Protect (formerly Tivoli Storage Manger) Server (CVE-2017-1105, CVE-2017-1297)

Summary IBM Spectrum Protect formerly Tivoli Storage Manager Server is affected by multiple IBM DB2 vulnerabilities that could allow a local user to overwrite DB2 files, cause a denial of service, or allow a local attacker to execute arbitrary code on the system. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Tivoli Network Manager IP Edition

Summary Websphere Application Server WAS is shipped as a component of IBM Tivoli Network Manager IP Edition. Information about a security vulnerability affecting WAS has been published in a security bulletin. Vulnerability Details Please consult following security bulletins in WebSphere Applicati...

Security Bulletin: A vulnerability in Net-SNMP affects IBM Tivoli Composite Application Manager for Transactions (CVE-2015-5621)

Summary Net-SNMP is vulnerable to a denial of service, caused by incompletely parsed varBind variables being left in the list of variables by the snmppduparse function. A remote attacker could exploit this vulnerability to cause the application to crash or possibly execute arbitrary code on the...

Security Bulletin: Vulnerabilities in IBM Java Runtime affects Rational Publishing Engine

Summary There are multiple vulnerabilities in IBM Java Runtime Environment, Versions 7 and 8 that are used by Rational Publishing Engine. Vulnerability Details CVEID: CVE-2017-10295 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit...

Security Bulletin: Vulnerability in IBM Java Runtime affects Rational Publishing Engine

Summary There is a vulnerability in IBM Java Runtime Environment, Versions 6 and 7 that are used by Rational Publishing Engine. Vulnerability Details CVEID: CVE-2017-3514 DESCRIPTION: An unspecified vulnerability in Oracle Java SE related to the Java SE AWT component could allow an unauthenticate...

Security Bulletin: IBM Security Proventia Network Active Bypass is affected by glibc vulnerability (CVE-2017-1000366)

Summary IBM Security Proventia Network Active Bypass has addressed the following vulnerability. CVE-2017-1000366 Vulnerability Details CVEID: CVE-2017-1000366 DESCRIPTION: Glibc could allow a local attacker to execute arbitrary code on the system, caused by a vulnerability that allows specially...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Security Directory Integrator

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7, Java™ Version 8 used by Security Directory Integrator. These issues were disclosed as part of the IBM Java SDK updates in Jul 2017. Vulnerability Details CVEID: CVE-2017-10116 DESCRIPTION: An unspecified...

Security Bulletin: Multiple Security vulnerabilities fixed in IBM Security Privileged Identity Manager

Summary There are multiple Security vulnerabilities that are fixed in the IBM Security Privileged Identity Manager Vulnerability Details CVEID: CVE-2016-5957 DESCRIPTION: IBM Security Privileged Identity Manager uses weaker than expected cryptographic algorithms that could allow an attacker to...

Security Bulletin: IBM Security Access Manager for Web is affected by vulnerabilities in OpenSSH (CVE-2016-3115, CVE-2016-1908)

Summary Vulnerabilities have been identified in OpenSSH. IBM Security Access Manager for Web uses OpenSSH and is affected by these vulnerabilities. Vulnerability Details CVEID: CVE-2016-3115 DESCRIPTION: OpenSSH could allow a remote authenticated attacker to execute arbitrary commands on the...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Security Network Protection

Summary There are multiple vulnerabilities in IBM Runtime Environment Java Technology Edition, Version 7 that is used by IBM Security Network Protection. These issues were disclosed as part of the IBM Java SDK updates in October 2015. Vulnerability Details CVEID: CVE-2015-4734 DESCRIPTION: An...

Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect IBM InfoSphere Guardium

Summary OpenSSL vulnerabilities were disclosed on June 11, 2015 by the OpenSSL Project. This includes Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol CVE-2015-4000. OpenSSL is used by IBM InfoSphere Guardium. IBM InfoSphere Guardium has addressed the applicable...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Security Network Protection

Summary There are multiple vulnerabilities in OpenSSL that is used by IBM Security Network Protection. These vulnerabilities include CVE-2014-8176, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792, CVE-2015-3216, and CVE-2015-1788. Vulnerability Details CVE ID: CVE-2014-8176 DESCRIPTION...

Security Bulletin: Vulnerabilities in Bash affect IBM Security Access Manager for Mobile and IBM Security Access Manager for Web (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory corruption vulnerabilities. Bash is used by IBM Security Access Manager for Mobile and IBM Security Access Manager...

Security Bulletin: IBM Security Proventia Network Active Bypass is affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerabilit...

Security Bulletin: Multiple vulnerabilities in PHP and memcached libraries affect IBM Tealeaf Customer Experience

Summary The IBM Tealeaf Customer Experience PCA component uses versions of PHP and memcached with reported security issues. Vulnerability Details CVEID: CVE-2013-0179 DESCRIPTION: memcached is vulnerable to a denial of service, caused by an error in the processbindelete function within memcached....

Security Bulletin: IBM Sterling Order Management and IBM Sterling Configure, Price, Quote are affected by multiple Apache Struts 2 security vulnerabilities.

Summary IBM Sterling Order Management and IBM Sterling Configure Price Quote use Apache Struts 2 and are affected by some of the vulnerabilities that exist in Apache Struts 2. Vulnerability Details CVEID: CVE-2013-4310 Description: Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to...