There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 SR10-FP40 and Version 8 SR5-FP30 used by IBM Tivoli Application Dependency Discovery Manager (TADDM). These issues were disclosed as part of the IBM Java SDK updates in April 2019.
CVEID: CVE-2019-2698 DESCRIPTION: An unspecified vulnerability related to the Java SE 2D component could allow an unauthenticated attacker to take control of the system.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/159790 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2019-2697 DESCRIPTION: An unspecified vulnerability related to the Java SE 2D component could allow an unauthenticated attacker to take control of the system.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/159789 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2019-2602 DESCRIPTION: An unspecified vulnerability related to the Java SE Libraries component could allow an unauthenticated attacker to cause a denial of service resulting in a high availability impact using unknown attack vectors.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/159698 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2019-2684 DESCRIPTION: An unspecified vulnerability related to the Java SE RMI component could allow an unauthenticated attacker to cause no confidentiality impact, high integrity impact, and no availability impact.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/159776 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVEID: CVE-2019-10245 DESCRIPTION: Eclipse OpenJ9 is vulnerable to a denial of service, caused by the execution of a method past the end of bytecode array by the Java bytecode verifier. A remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/160010 for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
TADDM 7.2.2.5
TADDM 7.3 (7.3.0.0 - 7.3.0.6)
Fix | VRMF | APAR | How to acquire fix |
---|
efix_jdk8.0.5.35_FP6190313.zip
|
7.3.0.6
| None |
[efix_jdk7.0.10.45_FP420171214.zip](<https://www.secure.ecurep.ibm.com/download/?id=ZrV3fsm9stxhyAIxHNXvLmgol0HE1fMGDN53Cki7cbM >) | 7.3.0.4 | None | Download eFix
efix_jdk7.0.10.45_FP520160209.zip
| 7.2.2.5 | None |
The eFix provided for 7.3.0.6 has been tested to work successfully on top on 7.3.0.5. Similarly, the eFix provided for 7.3.0.4 has been tested to work successfully on 7.3.0.0 - 7.3.0.3.
Please get familiar with the eFix readme in etc/efix_readme.txt
For each TADDM release (7.3.0, 7.2.2) there is a prepared replacement for Windows® 32-bit IBM JRE, Java Technology Edition, shipped separately on TADDM installation DVD discs.
Fix | VRMF | APAR | ** How to acquire fix** |
---|
ibm-java-jre-70-win-i386
|
7.3.0 (7.3.0.0 - 7.3.0.4) and 7.2.2
| None |
ibm-java-jre-80-win-i386
|
7.3.0.5 and 7.3.0.6
| None |