There are multiple vulnerabilities in IBM®Runtime Environment Java™Version 7 used by IBM Platform Cluster Manager Standard Edition, IBM Platform Cluster Manager Advanced Edition, Platform HPC, and Spectrum Cluster Foundation. These issues have been addressed in IBM Java SDK updates in April 2019.
CVEID: CVE-2019-2699 DESCRIPTION: Oracle’s JREs/JDKs on Windows ship with an old version of a Microsoft DLL which contains a vulnerability.
CVSS Base Score: 9
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/159791> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVEID: CVE-2019-2698 DESCRIPTION: An attacker can use a maliciously crafted font to exploit a flaw in the JDK’s font parsing code to overwrite memory addresses and cause a crash. Untrusted code running under a security manager may be able to elevate its privileges and execute arbitrary code.
CVSS Base Score: 8.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/159790> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVEID: CVE-2019-2697 DESCRIPTION: An attacker can use a maliciously crafted font to exploit a flaw in the JDK’s font parsing code to overwrite memory addresses and cause a crash. Untrusted code running under a security manager may be able to elevate its privileges and execute arbitrary code.
CVSS Base Score: 8.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/159789> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)
CVEID: CVE-2019-2602 DESCRIPTION: A flaw in the java.math.BigDecimal API causes hangs when parsing certain String values. This potentially allows an attacker to inflict a denial-of-service.
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/159698> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)
CVEID: CVE-2019-2684 DESCRIPTION: The Java runtime’s java.rmi.Registry implementation does not check access privileges correctly for some remote calls. This allows an attacker to effectively replace a number of predefined static skeleton classes with dynamic malicious skeletons.
CVSS Base Score: 5.9
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/159776> for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2019-10245 DESCRIPTION: A flaw in the OpenJ9 class verifier potentially allows untrusted code to elevate its privileges and execute arbitrary code.
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/160010> for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Platform Cluster Manager Version 4.2.0, 4.2.0.1, 4.2.0.2 and 4.2.1
Platform HPC Version 4.2.0 and 4.2.1
Spectrum Cluster Foundation 4.2.2
<Product
|
VRMF
|
APAR
|
Remediation/First Fix
—|—|—|—
Platform Cluster Manager Standard Edition
|
4.2.0, 4.2.0.1, 4.2.0.2, 4.2.1
|
None
|
See fix below
Platform Cluster Manager Advanced Edition
|
4.2.0, 4.2.0.1, 4.2.0.2, 4.2.1
|
None
|
See fix below
_Platform HPC _
|
4.2.0, 4.2.1
|
None
|
See fix below
Spectrum Cluster Foundation
|
4.2.2
|
None
|
See fix below
Platform Cluster Manager 4.2.x & Platform HPC 4.2.x & Spectrum Cluster Foundation 4.2.2
N/A
CPE | Name | Operator | Version |
---|---|---|---|
ibm spectrum cluster foundation | eq | any | |
platform cluster manager | eq | any | |
platform hpc for system x | eq | any |