Security Bulletin: Multiple Vulnerabilities in Apache Spark affects IBM Watson Studio Local

Summary Security Bulletin: Multiple Vulnerabilities in Apache Spark affects IBM Watson Studio Local Vulnerability Details CVEID: CVE-2018-11804 DESCRIPTION: Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. ...

Security Bulletin: Multiple Vulnerabilities in SQLite affects IBM Watson Studio Local

Summary Multiple Vulnerabilities in SQLite affects IBM Watson Studio Local Vulnerability Details CVEID: CVE-2019-9936 DESCRIPTION: In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Tivoli Netcool/OMNIbus (Multiple CVEs)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 5, 6, and 7 that are used by Tivoli Netcool/OMNIbus. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses the “FREAK: Factoring Attack...

Security Bulletin: IBM i is affected by DHCP vulnerabilities (CVE-2015-8605 and CVE-2016-2774).

Summary IBM i DHCP is vulnerable to several security vulnerabilities. Vulnerability Details CVEID: CVE-2015-8605 DESCRIPTION: ISC DHCP is vulnerable to a denial of service, caused by the failure to properly check the UDP payload length. By sending a specially crafted packet with an invalid IPv4 U...

Security Bulletin: Vulnerability CVE-2017-7494 in Samba affects IBM i

Summary Samba is supported on IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-7494 DESCRIPTION: Samba could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper access to named pipe endpoints. By uploading a...

Security Bulletin: Vulnerabilities in Bash affect IBM Netezza Host Management (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory corruption vulnerabilities. Bash is used by IBM Netezza Host Management. Vulnerability Details CVE-ID: CVE-2014-62...

Security Bulletin: Multiple vulnerabilities in HTTP/2 implementation used by WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in the HTTP/2 implementation that is used by WebSphere Application Server Liberty. This affects the servlet-4.0 and servlet-3.1 features. These vulnerabilities have been addressed. Vulnerability Details CVEID: CVE-2019-9518 DESCRIPTION: Multiple vendors...

Security Bulletin: IBM Cloud Private for Data is affected by a privilege escalation vulnerability in Kubernetes API server

Summary IBM Cloud Private for Data is affected by a security vulnerability in Kubernetes which in some cases can allow unauthorized access to the Kubernetes API Server and/or trusted user privilege escalation. Vulnerability Details CVEID: CVE-2018-1002105 DESCRIPTION: Kubernetes could allow a...

Security Bulletin: Synthetic Playback Agent 8.1.4 is affected by multiple vulnerabilities

Summary Synthetic Playback Agent has addressed the following vulnerabilities: CVE-ID: CVE-2019-11710 CVE-ID: CVE-2019-11721 CVE-ID: CVE-2019-11711 CVE-ID: CVE-2019-11730 CVE-ID: CVE-2019-11720 CVE-ID: CVE-2019-11714 CVE-ID: CVE-2019-11725 CVE-ID: CVE-2019-11715 CVE-ID: CVE-2019-11712 CVE-ID:...

Security Bulletin: IBM MessageSight is affected by the following four IBM Java vulnerabilities

Summary IBM MessageSight has addressed the following Java vulnerabilities: CVE-2018-12549: Eclipse OpenJ9 could allow a remote attacker to execute arbitrary code on the system. CVE-2018-12547: Eclipse OpenJ9 is vulnerable to a buffer overflow, caused by improper bounds checking by the jiosnprintf...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cloud Manager with OpenStack

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7.0.10.30 used by IBM Cloud Manager with OpenStack. IBM Cloud Manager with OpenStack has addressed the applicable CVEs. These issues were disclosed as part of the IBM Java SDK updates in October 2018. Vulnerabili...

Security Bulletin: Security vulnerability in the IBM HTTP Server (CVE-2018-17199)

Summary There is a vulnerability in the IBM HTTP Server used by WebSphere Application Server. Vulnerability Details CVEID: CVE-2018-17199 DESCRIPTION: Apache HTTP Server could allow a remote attacker to bypass security restrictions, caused by checking the session expiry time before decoding the...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private Vulnerability Advisor Kafka and Notification Dispatcher

Summary Security Vulnerabilities affect IBM Cloud Private Vulnerability Advisor Kafka and Notification Dispatcher Vulnerability Details CVEID: CVE-2018-1000802 DESCRIPTION: Python could allow a local attacker to execute arbitrary commands on the system, caused by a flaw in the shutil module...

Security Bulletin: IBM Dynamic System Analysis (DSA) Preboot is affected by vulnerabilities in libxml2 (CVE-2016-9318 CVE-2016-9597)

Summary IBM Dynamic System Analysis DSA Preboot has addressed the following vulnerabilities in libxml2. Vulnerability Details Summary IBM Dynamic System Analysis DSA Preboot has addressed the following vulnerabilities in libxml2. Vulnerability Details CVEID: CVE-2016-9318 Description: Libxml2 cou...

Security Bulletin: Vulnerabilities in NTP affect IBM Flex System Chassis Management Module

Summary IBM Flex System Chassis Management Module CMM has addressed the following vulnerabilities in NTP. Vulnerability Details Summary IBM Flex System Chassis Management Module CMM has addressed the following vulnerabilities in NTP. Vulnerability Details CVE-ID: CVE-2015-7973 Description: NTP...

Security Bulletin: Security vulnerability has been identified in IBM Systems Director, Tivoli Common Reporting shipped with IBM Systems Director Editions (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470)

Summary IBM Systems Director, Tivoli Common Reporting is shipped as a compo-nent of IBM Systems Director Editions. Information about a security vul-nerability affecting IBM Systems Director, Tivoli Common Reporting has been published in a security bulletin. Vulnerability Details Abstract IBM...

Security Bulletin: Multiple vulnerabilities in GNU C library (glibc) affects IBM Storwize V7000 Unified

Summary IBM Storwize V7000 Unified is shipped with GNU glibc, for which a fix is available for security vulnerabilities. Vulnerability Details GNU C library buffer overflow and denial of service vulnerabilities affect IBM Storwize V7000 Unified. CVEID: CVE-2017-15804 DESCRIPTION: GNU C Library ak...

Security Bulletin: Vulnerabilities in libjpeg affect IBM BladeCenter Advanced Management Module (AMM)

Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerabilities in libjpeg. Vulnerability Details CVEID: CVE-2018-11813 DESCRIPTION: libjpeg is vulnerable to a denial of service, caused by a large loop in the readpixel function in rdtarga.c. By persuading a vict...

Security Bulletin: OpenSSH vulnerability affects IBM Spectrum Protect Plus (CVE-2017-15906)

Summary OpenSSH is vulnerable to a denial of service vulnerability which affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2017-15906 DESCRIPTION: OpenSSH is vulnerable to a denial of service, caused by an error in the processopen function when in read-only mode. A remote...

Security Bulletin: IBM Cloud Manager with OpenStack is affected by a OpenSSL vulnerabilities (CVE-2018-0739)

Summary A security vulnerability has been identified in OpenSSL that is used by IBM Cloud Manager with OpenStack. IBM Cloud Manager with OpenStack has addressed this vulnerability. Vulnerability Details CVEID: CVE-2018-0739 DESCRIPTION: OpenSSL is vulnerable to a denial of service. By sending...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM Developer for z Systems (CVE-2018-2783 and CVE-2018-2814)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM Developer for z Systems. These issues were disclosed as part of the IBM Java SDK updates in April 2018. Vulnerability Details | Subscribe to My Notifications to be notified of important product...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Rational ClearCase (CVE-2018-0739)

Summary OpenSSL vulnerabilities were disclosed on March 27 2018 by the OpenSSL Project. OpenSSL is used by IBM Rational ClearCase. IBM Rational ClearCase has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2018-0739 DESCRIPTION: OpenSSL is vulnerable to a denial of service. By...

Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect IBM® SDK for Node.js™ in IBM Bluemix

Summary OpenSSL vulnerabilities were disclosed on June 11, 2015 by the OpenSSL Project. This includes the Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol CVE-2015-4000 which affects IBM SDK for Node.js in IBM Bluemix. Vulnerability Details CVEID: CVE-2015-4000...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Rational Business Developer (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attach for SSL/TLS affects IBM Rational Business Developer. Vulnerability Details CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Rational Application Developer for WebSphere Software included in Rational Developer for i and Rational Developer for AIX and Linux

Summary Portions of IBM Rational Application Developer for WebSphere Software are shipped as a component of Rational Developer for i RPG and COBOL + Modernization Tools, Java and EGL editions, and Rational Developer for AIX and Linux. OpenSSL vulnerabilities were disclosed on March 1, 2016 by the...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Versions 7, 7.1, 8 that are used by AIX. These issues were disclosed as part of the IBM Java SDK updates in April 2018. Vulnerability Details CVEID: CVE-2018-2800 DESCRIPTION: An unspecified vulnerability in Oracle Jav...

Security Bulletin: A vulnerability in wget affects PowerKVM

Summary PowerKVM is affected by a vulnerability in wget. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2016-4971 DESCRIPTION: GNU wget could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted HTTP redirect message...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM SONAS

Summary There are vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, that is used by IBM SONAS. IBM SONAS has addressed the applicable CVEs. Vulnerability Details SONAS is shipped with Java. Java is required for SONAS administration, for executing SONAS specific commands on the...

Security Bulletin: Multiple Apache Tomcat vulnerabilities affect IBM SONAS.

Summary Multiple Apache Tomcat vulnerabilities affect IBM SONAS. Vulnerability Details This bulletin relates to vulnerabilities in the Apache Tomcat component which is used to provide the product’s management GUI. The CLI interface is unaffected. CVEID: CVE-2016-0762 DESCRIPTION: Apache Tomcat...

Security Bulletin: Multiple vulnerabilitiy in OpenSSL affect IBM Storwize V7000 Unified

Summary Cross-protocol attack on TLS using SSLv2 Vulnerability Details OpenSSL is used in IBM Storwize V7000 Unified for providing communication security by encrypting data being transmitted. CVEID: CVE-2016-0705 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a double-free...

Security Bulletin: GNU C library (glibc) vulnerability affects IBM Hyper-Scale Manager Virtual Appliance (CVE-2015-0235)

Summary GNU C library glibc vulnerability that has been referred to as GHOST affects IBM Hyper-Scale Manager Virtual Appliance. Vulnerability Details CVEID: CVE-2015-0235 DESCRIPTION:The gethostbyname functions of the GNU C Library glibc are vulnerable to a buffer overflow. By sending a specially...

Security Bulletin: IBM Cloud Container Service is affected by two container file system vulnerabilities

Summary IBM Cloud Container Service is affected by the following vulnerabilities which in some cases allow unauthorized access to the file system on the cluster worker nodes, including deletion of arbitrary files and directories. This document describes the issues and mitigations. It also describ...

Security Bulletin: Multiple security vulnerabilities in IBM Cloud Manager with OpenStack affect IBM Cloud Orchestrator and Cloud Orchestrator Enterprise

Summary IBM Cloud Manager with OpenStack is shipped with IBM Cloud Orchestrator and Cloud Orchestrator Enterprise. Multiple security vulnerabilities have been identified in dnsmasq that is used by IBM Cloud Manager with OpenStack. Information about a security vulnerability affecting IBM Cloud...

Security Bulletin: SSLv3 POODLE Attack (CVE-2014-3566)

Summary SSLv3 POODLE Attack CVE-2014-3566 impacts IBM Service Deliver Manager. Vulnerability Details Review the following security bulletins for vulnerability details and information about fixes: Security Bulletin: Vulnerability in SSLv3 affects IBM WebSphere Application Server CVE-2014-3566...

Security Bulletin: IBM Tivoli Monitoring CPU utilization (CVE-2014-0963)

Summary IBM Tivoli Monitoring is affected by a problem related to the SSL implementation which, under very specific conditions, can cause CPU utilization to rapidly increase. Vulnerability Details CVE ID: CVE-2014-0963 DESCRIPTION: IBM Tivoli Monitoring is affected by a problem with the handling ...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Network Manager IP Edition (CVE-2015-2613, CVE-2015-2601,CVE-2015-4749,CVE-2015-2625 and CVE-2015-1931)

Summary IBM WebSphere Application Server is shipped as a component of Tivoli Network Manager IP Edition . Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin Vulnerability Details Please consult the security bulletin...

Security Bulletin: IBM Tivoli Storage FlashCopy Manager 4.1 and 3.2 UNIX and VMware is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0198, CVE-2010-5298, CVE-ID: CVE-2014-3470

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details CVE-ID: CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients an...

Potential Security Vulnerabilities With JavaTM SDKs

Abstract Security Bulletin: Asset and Service Mgmt Products - Potential security exposure when using JavaTM based applications due to vulnerabilities in Java Software Developer Kits. See Vulnerability Details for CVE IDs. Content VULNERABILITY DETAILS: CVE ID:...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Enterprise Content Management System Monitor

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version Java 6 and Java 7 used by Enterprise Content Management System Monitor. These issues were disclosed as part of the IBM Java SDK updates in October 2016. Vulnerability Details CVEID: CVE-2016-5573 DESCRIPTION:...

Security Bulletin: Security vulnerabilities have been identified in Jazz Team Server shipped with Jazz Reporting Service

Summary Jazz Team Server is shipped as a component of Jazz Reporting Service JRS. Information about security vulnerabilities affecting Jazz Team Server and Jazz-based products has been published in a security bulletin. Vulnerability Details CVEID: CVE-2016-8745 DESCRIPTION: Apache Tomcat could...

Security Bulletin: Rational Build Forge Security Advisory (CVE-2016-8610, CVE-2017-6056, CVE-2017-5647, CVE-2017-5648)

Summary Apache Tomcat and OpenSSL have security vulnerabilities that enables an attacker to exploit the application. Respective security vulnerabilities are discussed in detail in the subsequent sections. Vulnerability Details This section includes the vulnerability details that affect the Ration...

Security Bulletin: IBM Security Guardium is affected by Open Source Oracle MySQL Vulnerabilities (multiple CVEs)

Summary IBM Security Guardium is affected by Open Source Oracle MySQL Vulnerabilities. IBM Security Guardium addressed these issues Vulnerability Details CVEID: CVE-2016-0639 DESCRIPTION: An unspecified vulnerability in Oracle MySQL Server related to the Server: Pluggable Authentication component...

Security Bulletin: IBM Security Guardium is affected by Linux kernel privesc: Dirty COW vulnerability (CVE-2016-5195)

Summary Linux Kernel could allow a local attacker to gain elevated privileges on the system, caused by a race condition when handling the copy-on-write COW breakage of private read-only memory mappings by the memory subsystem. IBM Security Guardium has provided a fix for this vulnerability...

Security Bulletin: A security vulnerability has been identified in IBM® Java SDK that affect IBM Security Directory Suite (CVE-2016-5597) - October 2016 CPU

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition that is shipped with IBM Security Directory Suite. The issue was disclosed as part of the IBM Java SDK updates in October 2016 and includes the vulnerability. Vulnerability Details CVEID: CVE-2016-5597 DESCRIPTION: An unspecifi...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Tivoli Security Policy Manager (CVE-2016-5573, CVE-2016-5597)

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM Tivoli Security Policy Manager TSPM. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security...

Security Bulletin: Multiple vulnerabilities in NTP affect IBM Security Network Protection

Summary There are multiple vulnerabilities in NTP that is used by IBM Security Network Protection. These vulnerabilities include CVE-2015-5194, CVE-2015-5195, CVE-2015-5219, CVE-2015-7691, CVE-2015-7692, CVE-2015-7701, CVE-2015-7702, CVE-2015-7703, CVE-2015-7852, CVE-2015-7977, CVE-2015-7978,...

Security Bulletin: OpenSSL as used in IBM QRadar SIEM is vulnerable to a Denial of Service attack, and Sensitive Information Exposure. (CVE-2015-3194, CVE-2015-3195, CVE-2015-3196)

Summary OpenSSL vulnerabilities announced 12-3-15 this will also cover Node.js which consumes OpenSSL Vulnerability Details CVE-ID: CVE-2015-3194 Description: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference when verifying certificates via a malformed routine. An...

Security Bulletin: Multiple vulnerabilities addressed in the IBM Emptoris Sourcing product (CVE-2017-1447, CVE-2017-1449, CVE-2017-1450, CVE-2017-1444)

Summary The security bulletin includes multiple vulnerabilities found and addressed in IBM Emptoris Sourcing across various versions of the product. Vulnerability Details CVEID: CVE-2017-1447 DESCRIPTION: IBM Emptoris Sourcing is vulnerable to cross-site scripting. This vulnerability allows users...

Security Bulletin: IBM Sterling Order Management and IBM Sterling Configure, Price, Quote are affected by multiple Apache Struts 2 security vulnerabilities.

Summary IBM Sterling Order Management and IBM Sterling Configure Price Quote use Apache Struts 2 and are affected by some of the vulnerabilities that exist in Apache Struts 2. Vulnerability Details CVEID: CVE-2013-4310 Description: Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM InfoSphere Information Server

Summary OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM InfoSphere Information Server. IBM InfoSphere Information Server has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-0799 DESCRIPTION: OpenSSL could allow a remote...