There are multiple vulnerabilities in IBM® Runtime Environments Java™ Technology Edition, Version 6, that is used by WebSphere Dashboard Framework. These issues were disclosed as part of the IBM Java SDK updates in April 2016. The vulnerabilities may affect some configurations of products bundled with WebSphere Dashboard Framework.
CVEID: CVE-2016-3427**
DESCRIPTION:** An unspecified vulnerability in Oracle Java, SE Java SE Embedded and JRockit related to the JMX component has complete confidentiality impact, complete integrity impact, and complete availability impact.
CVSS Base Score: 10
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/112459> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVEID: CVE-2016-3426**
DESCRIPTION:** An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the JCE component could allow a remote attacker to obtain sensitive information resulting in a partial confidentiality impact using unknown attack vectors.
CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/112457> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVEID: CVE-2016-0264**
DESCRIPTION:** A buffer overflow vulnerability in the IBM JVM facilitates arbitrary code execution under certain limited circumstances.
CVSS Base Score: 5.6
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/110867> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
WebSphere Dashboard Framework 7.0.1
Obtain the JRE appropriate for your product from Fix Central. Note however that these updated JREs are only appropriate for customers that have installed the copy of Eclipse, WASCE, or Liberty bundled with WebSphere Dashboard Framework.
WebSphere Dashboard Framework (WDF) on Windows:
LO88931 - Java 6 for all versions of WDF 7.0.1
WebSphere Dashboard Framework (WDF) on Linux:
LO88932 - Java 6 for all versions of WDF 7.0.1
For previous versions of WebSphere Dashboard Framework IBM recommends upgrading to a fixed, supported version/release/platform of the product.
None