PT-2015-5503 · Ibm+2 · Ibm Java+3

Published 2015-05-13 · Updated 2019-06-13 · CVE-2015-1914

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Java versions prior to 7 R1 SR3 IBM Java versions prior to 7 SR9 IBM Java 6 R1 versions prior to SR8 FP4 IBM Java 6 versions prior to SR16 FP4 IBM Java 5.0 versions prior to SR16 FP10

Description The issue allows remote attackers to bypass permission checks and obtain sensitive information via vectors related to the Java Virtual Machine. Additionally, a vulnerability in IBM SSL/TLS implementations could allow a remote attacker to downgrade the security of certain SSL/TLS connections, facilitating brute-force decryption of TLS/SSL traffic between vulnerable clients and servers using man-in-the-middle techniques.

Recommendations For IBM Java 7 R1, update to SR3 or later. For IBM Java 7, update to SR9 or later. For IBM Java 6 R1, update to SR8 FP4 or later. For IBM Java 6, update to SR16 FP4 or later. For IBM Java 5.0, update to SR16 FP10 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-1914

RHSA-2015:1006

RHSA-2015:1007

RHSA-2015:1020

RHSA-2015:1021

RHSA-2015:1091

RHSA-2015_1006

RHSA-2015_1020

RHSA-2015_1021

SUSE-SU-2015:1073-1

SUSE-SU-2015:1161-1

Affected Products

Ibm Aix

Ibm Java

Red Hat

Suse

References · 65

• https://bdu.fstec.ru/vul/2015-09952 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-1006.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09956 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-1007.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1073-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1914 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09962 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-1020.html · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21883640 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1161-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09959 · Security Note