Security Bulletin: Vulnerabilities in Faster-XML jackson-databind affects IBM Operations Analytics Predictive Insights

Summary Faster-XML Jackson-databind is used by IBM Operations Analytics Predictive Insights. IBM Operations Analytics Predictive Insights has addressed the applicable CVEs. Note that the usage of Jackson-databind within IBM Operations Analytics Predictive Insights is limited to the REST Mediation...

Security Bulletin: A vulnerability in IBM Java Runtime affect Financial Transaction Manager for Check Services (CVE-2019-4732)

Summary There is vulnerability in IBM® Runtime Environment Java™ Version 8 used by Financial Transaction Manager for Check Services. Financial Transaction Manager for Check Services FTM CHK has addressed the applicable CVE.brIf you run your own Java code using the IBM Java Runtime delivered with...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Oct 2019 - Includes Oracle Oct 2019 CPU affects IBM Tivoli Composite Application Manager for Transactions-Robotic Response Time

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 ,version 8, that is used by IBM Tivoli Composite Application Manager for Transactions - Robotic Response Time. These issues were disclosed as part of the IBM Java SDK updates in October 2019. Vulnerability...

Security Bulletin: Cross-site Scripting and Vulnerable library - JQuery v1.11.1 affects IBM Engineering Workflow Management

Summary There are two vulnerabilities that affect IBM Engineering Workflow Management, there is a cross-site scripting stored in EWM code and actually library JQuery is vulnerable too. Vulnerability Details CVEID: CVE-2019-4747 DESCRIPTION: IBM Team Concert RTC is vulnerable to cross-site...

Security Bulletin: Multiple potential vulnerabilities in Node.js

Summary Node.js is potentially exposed to 2 identified vulnerabilities. Vulnerability Details CVEID: CVE-2019-15605 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by a flaw when handling unusual Transfer-Encoding HTTP header. By sending a specially-crafted request, an attack...

Security Bulletin: Multiple vulnerabilities in IBM Java shipped with IBM Transformation Extender Advanced

Summary Multiple vulnerabilities with IBM Java version shipped with IBM Transformation Extender Advanced. These vulnerabilities have been addressed. Vulnerability Details CVEID: CVE-2018-2663 DESCRIPTION: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere Message Broker and IBM Integration Bus

Summary Multiple security vulnerabilities exist in the IBM® Runtime Environment Java™ Technology Edition 6.0.16.21 and earlier used by WebSphere Message Broker, and the IBM® Runtime Environment Java™ Technology Edition 7.0.9.31 and earlier used by WebSphere Message Broker and IBM Integration Bus,...

Security Bulletin: IBM TNPM Wireline is vulnerable to Apache Commons Beanutils (CVE-2019-10086)

Summary There is a vulnerability in Apache Commons Beanutils that is used by IBM TNPM Wireline . This has been addressed. Vulnerability Details CVEID: CVE-2019-10086 DESCRIPTION: Apache Commons Beanutils could allow a remote attacker to gain unauthorized access to the system, caused by the failur...

Security Bulletin: Multiple vulnerabilities in HTTP/2 implementation used by Watson Knowledge Catalog for IBM Cloud Pak for Data

Summary There are multiple vulnerabilities in the WebSphere Application Server Liberty HTTP/2 implementation that is used by Watson Knowledge Catalog for IBM Cloud Pak for Data. This affects various Watson Knowledge Catalog services. These vulnerabilities have been addressed. Vulnerability Detail...

Security Bulletin: Multiple security vulnerabilities in IBM Java SDK affects IBM Voice Gateway

Summary Multiple security vulnerabilities in IBM Java SDK affects IBM Voice Gateway Vulnerability Details CVEID: CVE-2020-2604 DESCRIPTION: An unspecified vulnerability in Java SE could allow an unauthenticated attacker to take control of the system. CVSS Base score: 8.1 CVSS Temporal Score: See:...

Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by a libcurl security vulnerability (CVE-2019-5482)

Summary IBM Integrated Management Module II IMM2 is affected by a libcurl security vulnerability CVE-2019-5482 Vulnerability Details CVEID: CVE-2019-5482 DESCRIPTION: cURL libcurl is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the tftpreceivepacket function. ...

Security Bulletin: Multiple vulnerabilities exist in IBM Planning Analytics Local

Summary Vulnerabilities found in several components have been addressed in IBM Planning Analytics 2.0.5. There are vulnerabilities in IBM® Runtime Environment Java™ Version 7. These issues were disclosed as part of the IBM Java SDK updates in October 2017. Multiple vulnerabilities affect componen...

Security Bulletin: Vulnerabilities in Curl affect PowerSC (CVE-2019-5481, CVE-2019-5482)

Summary There are vulnerabilities in Curl that affect PowerSC. Vulnerability Details CVEID: CVE-2019-5481 DESCRIPTION: cURL libcurl is vulnerable to a denial of service, caused by a double free flaw during kerberos FTP data transfer. By sending a specially-crafted size of data, a remote attacker...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server that is shipped with IBM Rational ClearQuest (CVE-2016-3092)

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM Rational ClearQuest. Information about a security vulnerability affecting WAS has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Bulletin: Vulnerability in jQuery affects IBM Watson Studio Local

Summary Security Bulletin: Vulnerability in jQuery affects IBM Watson Studio Local Vulnerability Details CVEID: CVE-2019-11358 DESCRIPTION: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server which is used by IBM Rational ClearQuest (CVE-2019-10086)

Summary IBM WebSphere Application Server WAS is used by the IBM Rational ClearQuest server and web components. Information about a security vulnerability affecting WAS has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: Vulnerabilities in GNU binutils affect IBM Netezza Analytics

Summary Open Source Binutils is used by IBM Netezza Analytics. IBM Netezza Analytics has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-10534 DESCRIPTION: GNU Binutils is vulnerable to a denial of service, caused by an out-of-bounds memory write in the...

Security Bulletin: Multiple Vulnerabilities in IBM HTTP Server bundled with IBM Cloud Pak System (CVE-2019-0211 CVE-2019-0220)

Summary IBM HTTP Server is used by WebSphere Application Server bundled with IBM Cloud Pak System formerly known as PureApplication System. Information about security vulnerabilities affecting IBM HTTP Server have been published in a security bulletin. Vulnerability Details Consult the following...

Security Bulletin: Multiple vulnerabilities affect IBM Planning Analytics (CVE-2018-3180, CVE-2013-1624, CVE-2018-1933, CVE-2015-1832, CVE-2018-15494)

Summary This Security Bulletin addresses multiple vulnerabilities that have been remediated in IBM Planning Analytics 2.0.7. There is a vulnerability in IBM® Runtime Environment Java™ used by IBM Planning Analytics 2.0.6 and lower. IBM Planning Analytics 2.0.7 has addressed the applicable CVE by...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerabilities (CVE-2018-0732, CVE-2018-0739, CVE-2017-3735)

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerabilities 3 issues for OpenSSL: 2 for a denial of service and 1 for an error while parsing an IPAdressFamily extension in an X.509 certificate. Vulnerability Details CVEID:...

Security Bulletin: IBM Aspera Faspex, IBM Aspera Console are affected by OpenSSL Vulnerability (CVE-2018-0739)

Summary IBM Aspera Faspex, IBM Aspera Console have addressed the following OpenSSL vulnerability. Vulnerability Details Vulnerability Details CVEID: CVE-2018-0739 DESCRIPTION: OpenSSL is vulnerable to a denial of service. By sending specially crafted ASN.1 data with a recursive definition, a remo...

Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM Worklight and IBM MobileFirst Platform Foundation

Summary OpenSSL vulnerabilities were disclosed on 30 October 2018 and later by the OpenSSL Project. OpenSSL is used by IBM Worklight and IBM MobileFirst Platform Foundation. IBM Worklight and IBM MobileFirst Platform Foundation have addressed the applicable CVEs. Vulnerability Details CVE-ID:...

Security Bulletin: Vulnerability in glibc affects Intel® Manycore Platform Software Stack (Intel® MPSS) for Linux and Windows (CVE-2016-10228)

Summary IntelR Manycore Platform Software Stack IntelR MPSS for Linux and Windows have addressed the following vulnerability in glibc. Vulnerability Details Summary Intel® Manycore Platform Software Stack Intel® MPSS for Linux and Windows have addressed the following vulnerability in glibc...

Security Bulletin: Vulnerabilities in OpenSSL affect Juniper EX Series Network Switches sold by IBM for use in IBM Products (CVE-2014-3569, CVE-2014-3570, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204, CVE-2015-0205)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes "FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by Juniper EX Series Network Switches sold by IBM for use in IBM Products. Juniper has...

Security Bulletin: Vulnerability in Open SSL affects IBM System Networking products

Summary Open SSL used in the System Networking Products is impacted by the CVEs as outlined in the details below. Vulnerability Details Abstract Open SSL used in the System Networking Products is impacted by the CVEs as outlined in the details below. Content Vulnerability Details: CVE-ID:...

Security Bulletin: Vulnerabilities in Bash affect IBM Flex System FC5022 16Gb Fibre Channel SAN Switch (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Vulnerability Details Abstract Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as "Bash Bug" or "Shellshock" and two memory corruption vulnerabilities. Bash is used by IBM Flex System FC5022 16Gb Fibre Channel SAN...

Security Bulletin: Vulnerabilities in php5 affect IBM Flex System Manager (FSM): (CVE-2013-4248 CVE-2013-6420 CVE-2014-2497 CVE-2014-4049)

Summary A security vulnerability has been discovered in openssh that is included in IBM FSM. Vulnerability Details Abstract Security vulnerabilities have been discovered in php5 that is included in IBM FSM. Content Vulnerability Details: CVE-ID: CVE-2013-4248 DESCRIPTION: PHP could allow a remote...

Security Bulletin: IBM System x Integrated Management Module (IMM) is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0076

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project Vulnerability Details Abstract Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project Content Vulnerability Detail...

Security Bulletin: IBM ToolsCenter (including ToolsCenter Suite, ASU, DSA, and USXPi) is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details Abstract Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Content Vulnerability...

Security Bulletin: OpenSSL vunerability

Summary IBM MessageSight has addressed the following vulnerability. OpenSSL could allow a remote attacker to obtain sensitive information, caused by a timing side channel attack in the DSA signature algorithm. An attacker could exploit this vulnerability using variations in the signing algorithm ...

Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private Cloud Foundry (CVE-2018-3646, CVE-2018-3615, CVE-2018-3620)

Summary IBM Cloud Private Cloud Foundry is vulnerable to multiple security vulnerabilities Vulnerability Details CVEID: CVE-2018-3646 DESCRIPTION: Multiple Intel CPU's could allow a local attacker to obtain sensitive information, caused by a flaw in the CPU speculative branch instruction executio...

Security Bulletin: Multiple vulnerabilities in Java SDK affect IBM b-type SAN directors and switches.

Summary There are multiple vulnerabilities in SDK Java™ Technology Edition used by IBM b-type SAN directors and switches. These issues were disclosed as part of the Java SDK updates in January 2018. Vulnerability Details CVEID: CVE-2018-2579 DESCRIPTION: An unspecified vulnerability in Oracle Jav...

Security Bulletin: IBM has released updated AIX and VIOS fixes for CVE-2017-5715, known as Spectre, that are only applicable to some POWER9 systems.

Summary IBM has released updated AIX and VIOS fixes for CVE-2017-5715, known as Spectre, that are only applicable to the following POWER9 systems: 9040-MR9 9080-M9S The prtconf command may be used to find the system model number. For example: prtconf | grep "System Model" Vulnerability Details...

Security Bulletin: Security vulnerability has been identified in Jazz Team Server shipped with Jazz Reporting Service (CVE-2018-2973)

Summary Jazz Team Server is shipped as a component of Jazz Reporting Service JRS. Information about multiple security vulnerabilities affecting Jazz Team Server and Jazz-based products has been published in a security bulletin. Vulnerability Details CVEID: CVE-2018-2973 DESCRIPTION: An unspecifie...

Security Bulletin: IBM® DB2® LUW on AIX and Linux Affected by vulnerabilities in zlib (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843).

Summary IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server is affected by vulnerabilities in zlib. Vulnerability Details CVEID: CVE-2016-9840 DESCRIPTION: zlib is vulnerable to a denial of service, caused by an out-of-bounds pointer arithmetic in inftrees.c. By persuading a victim to...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect CICS Transaction Gateway

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 used by CICS Transaction Gateway. These issues were disclosed as part of the IBM Java SDK updates in April 2018. Vulnerability Details If you run your own Java code using the IBM Java Runtime...

Security Bulletin: Vulnerabilities in NTP affect AIX

Summary There are multiple vulnerabilities in NTPv3 and NTPv4 that affect AIX. Vulnerability Details NTPv3 is vulnerable to: CVEID: CVE-2014-5209 DESCRIPTION: NTP could allow a remote attacker to obtain sensitive information. By sending a GETRESTRICT control message, an attacker could exploit thi...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Cloud Manager with OpenStack

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7.0.10.20 used by IBM Cloud Manager with OpenStack. These issues were disclosed as part of IBM SDK, Java Technology Edition Quarterly CPU - Apr 2018 - Includes Oracle Apr 2018 CPU. IBM Cloud Manager with...

Security Bulletin: Multiple vulnerabilities might affect IBM® SDK for Node.js™

Summary Vulnerabilities in Node.js and the c-ares library were disclosed on July 11 2017 by the Node.js Foundation. IBM SDK for Node.js has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-11499 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by a flaw relate...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Cloud Manager

Summary Multiple vulnerabilitieshave been identified in OpenSSL OpenSSL and Node.JS consumers . OpenSSL is used by IBM Cloud Manager. IBM Cloud Manager has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-3730 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused b...

Security Bulletin: IBM WebSphere Cast Iron Solution is affected by Tomcat vulnerabilities

Summary IBM WebSphere Cast Iron Solution has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2017-5664 DESCRIPTION: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the improper handling of specific HTTP request methods for static...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect eDiscovery Analyzer

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 used by eDiscovery Analyzer. These issues were disclosed as part of the IBM Java SDK updates in April 2018. Vulnerability Details CVEID: CVE-2018-2783 DESCRIPTION: An unspecified vulnerability in Oracle Jav...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Business Developer.

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 & 8 and IBM® Runtime Environment Java™ Version 7 & 8 used by Rational Business Developer. These issues were disclosed as part of the IBM Java SDK updates in April 2018. Vulnerability Details CVEID:...

Security Bulletin: Multiple Security Issues in IBM Tealeaf Customer Experience on Cloud Network Capture Add-On

Summary Multiple vulnerabilities in Apache HTTPD can cause denial of service and allow a remote attacker to bypass security restrictions and obtain sensitive information in IBM Tealeaf Customer Experience on Cloud Network Capture Add-On. A Vulnerability in the Memcached library used by the IBM...

Security Bulletin: Vulnerability in IBM Java Runtime affects IBM Rational ClearCase (CVE-2016-3426)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Versions 6, 7, and 8, which are used by IBM Rational ClearCase. This issue was disclosed as part of the IBM Java SDK updates in April 2016. Vulnerability Details CVEID: CVE-2016-3426 DESCRIPTION: An unspecified...

Security Bulletin: Java security vulnerabilities in ClearCase Remote Client (CVE-2014-4263, CVE-2014-4244)

Summary Flaws in the Java runtime Secure Sockets implementation may expose CCRC communications to an attacker. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information requires login with your IBM ID...

Security Bulletin: Vulnerability in OpenSSL( CVE-2016-0800 ) affect IBM WebSphere MQ on OpenVMS Alpha & Itanium when using HP OpenSSL V1.4 kit

Summary OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by HP SSL 1.4 on HP OpenVMS. IBM WebSphere MQ on OpenVMS Alpha & Itanium uses HP SSL and has addressed the applicable CVE CVE-2016-0800 the “DROWN: Decrypting RSA with Obsolete and Weakened...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum Conductor with Spark

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition used by IBM Spectrum Conductor with Spark. These issues were disclosed as part of the IBM Java updates in January 2018. Vulnerability Details CVEID: CVE-2018-2579 DESCRIPTION: An unspecified vulnerability in Oracle Ja...

Security Bulletin: Multiple vulnerabilities in ntp affect IBM Flex System Manager (FSM)

Summary Multiple vulnerabilities have been identified in ntp that is embedded in the FSM. This bulletin addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2017-6464 DESCRIPTION: NTP is vulnerable to a denial of service. A remote authenticated attacker could exploit this vulnerabili...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Flex System Manager (FSM) Storage Manager Install Anywhere (SMIA) configuration tool

Summary OpenSSL vulnerabilities were disclosed on January 26, 2017 by the OpenSSL Project. OpenSSL was used by IBM FSM SMIA configuration tool commonly known as Network Advisor. This bulletin addresses the applicable CVEs. Vulnerability Details CVEID: CVE-2017-3730 DESCRIPTION: OpenSSL is...