Security Bulletin: Vulnerabilities in php5 affect IBM Flex System Manager (FSM): (CVE-2013-4248 CVE-2013-6420 CVE-2014-2497 CVE-2014-4049)

Summary A security vulnerability has been discovered in openssh that is included in IBM FSM. Vulnerability Details Abstract Security vulnerabilities have been discovered in php5 that is included in IBM FSM. Content Vulnerability Details: CVE-ID: CVE-2013-4248 DESCRIPTION: PHP could allow a remote...

Security Bulletin: IBM ToolsCenter (including ToolsCenter Suite, ASU, DSA, and USXPi) is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details Abstract Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Content Vulnerability...

Security Bulletin: Vulnerabilities in OpenSSL affect AIX (CVE-2018-0734, CVE-2018-5407)

Summary There are vulnerabilities in OpenSSL used by AIX. Vulnerability Details CVEID: CVE-2018-0734 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a timing side channel attack in the DSA signature algorithm. An attacker could exploit this...

Security Bulletin: Vulnerability in Oracle Solaris affects AIX (CVE-2017-3623)

Summary There is a vulnerability in Oracle Solaris that affects AIX. Vulnerability Details CVEID: CVE-2017-3623 DESCRIPTION: An unspecified vulnerability in Oracle Sun Systems related to the Solaris Kernel RPC component could allow an unauthenticated attacker to take control of the system. CVSS...

Security Bulletin: Vyatta 5600 vRouter Software Patches - Release 1801q

Summary AT&T has released version 1801q for the Vyatta 5600. Details of this release can be found at https://console.bluemix.net/docs/infrastructure/virtual-router-appliance/vyatta-5600-security-fixes.htmlat-t-vyatta-5600-vrouter-software-patches Vulnerability Details CVEID: CVE-2018-13405...

Security Bulletin: IBM Security Proventia Network Active Bypass is affected by openssl vulnerabilities (CVE-2017-3738, CVE-2017-3737)

Summary IBM Security Proventia Network Active Bypass has addressed the following vulnerabilities. CVE-2017-3738, CVE-2017-3737 Vulnerability Details CVEID: CVE-2017-3738 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow bug in the AVX2...

Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM® SDK for Node.js™

Summary OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM SDK for Node.js. IBM SDK for Node.js has addressed the applicable CVEs including the "DROWN: Decrypting RSA with Obsolete and Weakened eNcryption" vulnerability. Vulnerability Details...

Security Bulletin: IBM WebSphere Cast Iron Solution is affected by Tomcat vulnerabilities

Summary IBM WebSphere Cast Iron Solution has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2017-5664 DESCRIPTION: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the improper handling of specific HTTP request methods for static...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect eDiscovery Analyzer

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 used by eDiscovery Analyzer. These issues were disclosed as part of the IBM Java SDK updates in April 2018. Vulnerability Details CVEID: CVE-2018-2783 DESCRIPTION: An unspecified vulnerability in Oracle Jav...

Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private (‪CVE-2017-3738, CVE-2017-3736)‬‬‬

Summary IBM Cloud Private is vulnerable to multiple security vulnerabilities Vulnerability Details CVEID: CVE-2017-3738 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow bug in the AVX2 Montgomery multiplication procedure used in...

Security Bulletins - IBM Planning Analytics, Cognos TM1 and Cognos Insight

Problem IBM Planning Analytics and Cognos TM1 Security Bulletins and Alerts. Resolving The Problem Tab navigation PA 2.0.x TM1 10.2.x Insight 10.2.x Concert 4.0.2 Security bulletins and Alerts for IBM Planning Analytics 2.0.x. --- Published / Updated | Title July 2018 | Security Bulletin: Multipl...

Security Bulletin: FileNet Capture is affected by GSKit and GSKit-Crypto vulnerabilities

Summary FileNet Capture has addressed multiple GSKit and GSKit-Crypto vulnerabilities. Vulnerability Details CVEID: CVE-2017-3732 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a carry propagating bug in the x8664 Montgomery squaring procedure. An...

Security Bulletin: Open Source Apache Struts Vulnerabilities affect IBM Platform Cluster Manager Standard Edition, IBM Platform Cluster Manager Advanced Edition, Platform HPC, and Spectrum Cluster Foundation

Summary Open Source Apache Struts Vulnerabilities were addressed by IBM Platform Cluster Manager Standard Edition, IBM Platform Cluster Manager Advanced Edition, Platform HPC, and Spectrum Cluster Foundation. Vulnerability Details CVE-ID: CVE-2017-12611 Description: Apache Struts could allow a...

Security Bulletin: IBM API Connect Developer Portal is impacted by PHP vulnerabilities (CVE-2018-10548, CVE-2018-10546)

Summary IBM API Connect has addressed the following vulnerabilities. PHP is vulnerable to a denial of service, caused by a NULL pointer dereference in ext/ldap/ldap.c. By sending specially crafted data, an attacker could exploit this vulnerability to mishandle the ldapgetdn return value and cause...

Security Bulletin: A vulnerability in nginx affects PowerKVM

Summary PowerKVM is affected by a vulnerability in nginx. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2017-7529 DESCRIPTION: Nginx could allow a remote attacker to obtain sensitive information, caused by an integer overflow in Nginx range filter module. By sending...

Security Bulletin: Vulnerabilities in Graphite2 affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in the Graphite 2 Library. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2017-7778 DESCRIPTION: Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write i...

Security Bulletin: Vulnerabilities in OpenSSH affect IBM Flex System Manager (FSM)

Summary Multiple vulnerabilities have been identified in openSSH that is embedded in the IBM FSM. This fix addresses these vulnerabilities Vulnerability Details CVEID: CVE-2015-5352 DESCRIPTION: OpenSSH could allow a remote authenticated attacker to bypass security restrictions, caused by an erro...

Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple php vulnerabilities

Summary Multiple vulnerabilities have been identified in php that is embedded in the IBM FSM. This fix addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2016-7124 DESCRIPTION: PHP is vulnerable to a denial of service, caused by the improper handling of invalid objects by...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect PowerKVM

Summary OpenSSL vulnerabilities were disclosed on March 3, 2016 and May 3, 2016 by the OpenSSL Project. OpenSSL is used by PowerKVM, which has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2105 DESCRIPTION: OpenSSL is vulnerable to a heap-based buffer overflow, caused by...

Security Bulletin: Vulnerabilities in NetworkManager affect PowerKVM (CVE-2015-0272,CVE-2015-2924)

Summary PowerKVM is affected by vulnerabilities in NetworkManager. These vulnerabilities are now fixed. Vulnerability Details CVEID: CVE-2015-0272 DESCRIPTION: GNOME NetworkManager is vulnerable to a denial of service. A remote attacker could exploit this vulnerability using a specially crafted M...

Security Bulletin: A vulnerability in nss-util affects PowerKVM (CVE-2016-1950)

Summary PowerKVM is affected by a vulnerability in nss-util. This vulnerability is now fixed. Vulnerability Details CVEID: CVE-2016-1950 DESCRIPTION: Mozilla Firefox is vulnerable to a heap-based buffer overflow, caused by improper bounds checking when the Network Security Services NSS libraries...

Security Bulletin: IBM Pure Power Integrated Manager (PPIM) is affected by multiple ntp vulnerabilities

Summary Multiple security vulnerabilities have been discovered in ntp embedded in the IBM PPIM. This bulletin addresses these issues. Vulnerability Details CVEID: CVE-2015-8138 DESCRIPTION: NTP could allow a remote attacker to bypass security restrictions. By sending a specially crafted packet wi...

Security Bulletin: Vulnerabilities in OpenSSL affect PowerKVM (Multiple CVEs)

Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL is used by PowerKVM. PowerKVM has addressed the applicable CVEs Vulnerability Details CVEID: CVE-2015-0209 DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: January 2016 OpenSSL Vulnerabilities in Multiple N series Products

Summary Multiple N series products incorporate the OpenSSL software libraries to provide cryptographic capabilities. OpenSSL versions below 1.0.2f and 1.0.1r are susceptible to vulnerabilities that could lead to man-in-the-middle attacks. Multiple N series Products have addressed the applicable...

Security Bulletin: Multiple Mozilla Firefox vulnerability issues in IBM Storwize V7000 Unified

Summary There are security vulnerabilities in versions of Mozilla Firefox that are shipped with versions 1.5.1.0 to 1.5.2.6 of IBM Storwize V7000 Unified Vulnerability Details IBM Storwize V7000 Unified is shipped with Mozilla Firefox. There are vulnerabilities in certain versions of Mozilla...

Security Bulletin: Apache Tomcat security vulnerability issues on IBM Storwize V7000 Unified system (CVE-2013-4286, CVE-2014-0033, CVE-2013-4322, CVE-2013-4590)

Summary IBM Storwize V7000 Unified system is shipped with Apache Tomcat, for which fixes are available for four security vulnerabilities. Vulnerability Details CVEID: CVE-2013-4286 CVE-2014-0033 CVE-2013-4322 CVE-2013-4590 DESCRIPTION: Apache Tomcat is used in IBM Storwize V7000 Unified system fo...

Security Bulletin: Multiple security vulnerabilities have been identified in WebSphere Application Server and bundling products shipped with IBM Cloud Orchestrator (CVE-2016-3426, CVE-2016-3427)

Summary Information about a security vulnerability that affects IBM Java SDK, IBM WebSphere Application Server, and bundling products of IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise Edition has been published in a security bulletin. These issues were also addressed by IBM WebSpher...

Security Bulletin: IBM SmartCloud Provisioning security vulnerability has been identified in nginx (CVE-2016-4450)

Summary IBM SmartCloud Provisioning and SmartCloud Provisioning for Software Virtual Appliaance ships with nginx. A denial of service vulnerability has been identified in nginx CVE-2016-4450. Vulnerability Details CVE-ID: CVE-2016-4450 Description: nginx is vulnerable to a denial of service, caus...

Security Bulletin: Multiple vulnerabilities in GNU grep affect IBM SmartCloud Provisioning for IBM Software Virtual Appliance (CVE-2015-1345, CVE-2012-5667)

Summary Multiple vulnerability in GNU grep affect IBM SmartCloud Provisioning for IBM Software Virtual Appliance. Vulnerability Details CVEID: CVE-2015-1345 DESCRIPTION: GNU grep is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by an error in kwset.c. A remote...

Security Bulletin: IBM Tivoli Common Reporting (TCR) 2017Q3 Security Updater: TCR, a part of IBM Jazz for Service Management (JazzSM) is affected by multiple vulnerabilities

Summary Fixes of Cognos Business Intelligence are provided as part of TCR fixes This bulletin addresses several security vulnerabilities. There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 and IBM® Runtime Environment Java™ Technology Edition, Versi...

Security Bulletin: IBM Tivoli Monitoring Agent Framework component. (CVE-2016-9840, CVE-2016-9841, CVE-2016-9843)

Summary IBM Tivoli Monitoring uses zlib compression library in both the General services library and the File Transfer component. This bulletin address several reported vulnerabilities in the zlib compression library. Vulnerability Details CVEID: CVE-2016-9840 DESCRIPTION: zlib is vulnerable to a...

Security Bulletin: Vulnerabilities in OpenSSL affects IBM Tivoli Composite Application Manager for Transactions

Summary Vulnerabilities in OpenSSL were disclosed by openssl.org. OpenSSL 1.0.2j, used by IBM Tivoli Composite Application Manager for Transactions ISM, has addressed these vulnerabilities. Vulnerability Details CVE-ID: CVE-2000-1254 Description: OpenSSL could allow a remote attacker to obtain...

Security Bulletin: A vulnerability in SQLite affects IBM Tivoli Composite Application Manager for Transactions (CVE-2016-6153 )

Summary SQLite could allow a local attacker to gain elevated privileges on the system, caused by the creation of temporary files in directory with insecure permissions. An attacker could exploit this vulnerability to obtain leaked data. Vulnerability Details CVEID: CVE-2016-6153 DESCRIPTION: SQLi...

Security Bulletin: Linux kernel privesc Dirty COW vulnerability affects Tivoli Business Service Manager (CVE-2016-5195)

Summary A vulnerability in the Linux kernel privesc impacts Tivoli Business Service Manager TBSM on Linux platform. Vulnerability Details CVEID: CVE-2016-5195 Description: Linux Kernel could allow a local attacker to gain elevated privileges on the system, caused by a race condition when handling...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Tivoli System Automation for Multiplatforms (CVE-2015-3183)

Summary WebSphere Application Server is shipped as a component of IBM Tivoli System Automation for Multiplatforms. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details CVEID: CVE-2015-3183 DESCRIPTION:...

Security Bulletin: A security vulnerability has been identified in IBM Java SDK affecting WebSphere Application Server shipped with IBM Tivoli Network Manager IP Edition (CVE-2014-4263 and CVE-2014-4244)

Summary IBM® SDK Java™ Technology Edition integrated within WebSphere Application Server is shipped as a component of IBM Tivoli Network Manager IP Edition. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability...

Security Bulletin: TADDM - Struts V1 ClassLoader manipulation vulnerability (CVE-2014-0114).

Summary TADDM is vulnerable to Open Source Apache Struts V1 ClassLoader manipulation that allow a remote attacker to execute arbitrary code on the system, caused by the failure to restrict the setting of Class Loader attributes. Vulnerability Details CVE-ID: CVE-2014-0114 Description: Apache Stru...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Content Manager Records Enabler (CVE-2016-3426, CVE-2016-3427)

Summary IBM WebSphere Application Server is shipped as a component of IBM Content Manager Records Enabler. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin...

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affect IBM Content Classification (CVE-2016-0494, CVE-2016-0466 and CVE-2016-0603)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6.0 that is used by IBM Content Classification. These vulnerabilities have different impacts and different levels of risk. Vulnerability Details CVEID: CVE-2016-0494 DESCRIPTION: An unspecifie...

Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability (CVE-2014-0114) in IBM Content Navigator

Summary Security Bulletin: Open Source Apache Struts V1 ClassLoader manipulation vulnerability CVE-2014-0114 in IBM Content Navigator Vulnerability Details CVEID: CVE-2014-0114 DESCRIPTION: Open Source Apache Struts V1 ClassLoader manipulation vulnerability CVSS Base Score: 7.5 CVSS Temporal Scor...

Security Bulletin: Rational Build Forge Security Advisory (CVE-2016-8610, CVE-2017-6056, CVE-2017-5647, CVE-2017-5648)

Summary Apache Tomcat and OpenSSL have security vulnerabilities that enables an attacker to exploit the application. Respective security vulnerabilities are discussed in detail in the subsequent sections. Vulnerability Details This section includes the vulnerability details that affect the Ration...

Security Bulletin: Vulnerability in IBM Java Runtime affects Rational Publishing Engine (CVE-2015-7575)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Versions 6 and 7 that are used by Rational Publishing Engine. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID:...

Security Bulletin: Multiple security vulnerabilities have been identified in Jazz Team Server shipped with Jazz Reporting Service (CVE-2016-0483, CVE-2015-7575, CVE-2016-0448, CVE-2016-0466)

Summary Jazz Team Server is shipped as a component of Jazz Reporting Service. Information about multiple security vulnerabilities affecting Jazz Team Server and Jazz-based products has been published in a security bulletin. Vulnerability Details Consult the security bulletin Security Bulletin:...

Security Bulletin: Vulnerability in OpenSSL affects Rational Tau (CVE-2015-3194)

Summary OpenSSL vulnerabilities were disclosed on December 3, 2015 by the OpenSSL Project. OpenSSL is used by Rational Tau. Rational Tau has addressed the applicable CVE CVE-2015-3194. Vulnerability Details CVEID: CVE-2015-3194 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by ...

Security Bulletin: Security vulnerability in Oracle Java 7 impacts IBM Rational Collaborative Lifecycle Management products (CVE-2013-0422)

Summary Potential security vulnerability issues may occur if you are using the Oracle Java 7 updates reported in Oracle Security Alert for CVE-2013-0422 when using IBM Collaborative Lifecycle Management CLM products Rational Quality Manager, Rational Team Concert and Rational Requirements Compose...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Network Protection

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 Service Refresh 10 Fix Pack used by IBM Security Network Protection. These issues were disclosed as part of the IBM Java SDK updates in July 2017. Vulnerability Details CVEID: CVE-2017-10198 DESCRIPTION: An...

Security Bulletin: IBM QRadar Network Security is affected by vulnerabilities in Linux kernel

Summary IBM QRadar Network Security has addressed vulnerabilities in Linux kernel. Vulnerability Details CVEID: CVE-2017-6074 DESCRIPTION: Linux kernel is vulnerable to a denial of service, caused by improper handling of DCCPPKTREQUEST packet data structures in the LISTEN state by the...

Security Bulletin: Multiple Security vulnerabilities fixed in IBM Security Privileged Identity Manager

Summary There are multiple Security vulnerabilities that are fixed in the IBM Security Privileged Identity Manager Vulnerability Details CVEID: CVE-2016-5957 DESCRIPTION: IBM Security Privileged Identity Manager uses weaker than expected cryptographic algorithms that could allow an attacker to...

Security Bulletin: Vulnerabilities in GNU C library (glibc) affect IBM Security Network Protection

Summary The GNU glibc packages provide the standard C libraries libc, POSIX thread libraries libpthread, standard math libraries libm, and the Name Server Caching Daemon nscd used by multiple programs on the system. Security vulnerabilities have been discovered in glibc used with IBM Security...

Security Bulletin: IBM Security Guardium is affected by Open Source Oracle MySQL Vulnerabilities (multiple CVEs)

Summary IBM Security Guardium is affected by Open Source Oracle MySQL Vulnerabilities. IBM Security Guardium addressed these issues Vulnerability Details CVEID: CVE-2016-0639 DESCRIPTION: An unspecified vulnerability in Oracle MySQL Server related to the Server: Pluggable Authentication component...