IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MQ and IBM MQ Appliance

Dec 6, 2017 10:00 am EST

Categorized: High Severity

Share this post:

There are multiple vulnerabilities in IBM® Runtime Environment Java™ versions 6, 7 and 8 used by IBM MQ and IBM MQ Appliance. These issues were disclosed as part of the IBM Java SDK updates in July 2017.

CVE(s): CVE-2017-10108, CVE-2017-10109, CVE-2017-10115, CVE-2017-10116

Affected product(s) and affected version(s):

IBM MQ 9.0.0.x Long Term Support (LTS)
Maintenance level 9.0.0.1 and earlier

IBM MQ 9.0.x Continuous Delivery Release (CDR)
Continuous delivery update 9.0.3 and earlier

IBM MQ Appliance 9.0.x
Update 9.0.3 and earlier

IBM MQ 8.0
Maintenance levels 8.0.0.7 and earlier

IBM MQ Appliance 8.0
Maintenance levels 8.0.0.7 and earlier

WebSphere MQ 7.5
Maintenance levels 7.5.0.8 and earlier

WebSphere MQ 7.1
Maintenance levels 7.1.0.8 and earlier

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/2AxYQWz
X-Force Database: http://ift.tt/2vff6pW
X-Force Database: http://ift.tt/2vEvu3j
X-Force Database: http://ift.tt/2xsr7ZC
X-Force Database: http://ift.tt/2wyaY8O

from IBM Product Security Incident Response Team http://ift.tt/2B8uwmc