There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 Service Refresh 9 Fix Pack 31 and earlier releases, and IBM® Runtime Environment Java™ Version 7R1 Service Refresh 3 Fix Pack 31 and earlier releases, that is used by IBM MQ Light. These issues were disclosed as part of the IBM Java SDK updates in April 2016.
CVEID: CVE-2016-3426**
DESCRIPTION:** An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the JCE component could allow a remote attacker to obtain sensitive information resulting in a partial confidentiality impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/112457> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
The vulnerabilities affect users of IBM MQ Light 1.0, 1.0.0.1, 1.0.0.2, 1.0.2 on all platforms
This issue has been addressed by IBM MQ Light 1.0.3
Download and install the latest MQ Light Server appropriate for your platform: https://developer.ibm.com/messaging/mq-light/.
The following link describes how to re-use the data from your existing installation:
_http://www.ibm.com/support/knowledgecenter/SSBJCR_1.0.0/com.ibm.mq.koa.doc/tmql_data.htm _.
None