IBM Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server for Bluemix April 2016 CPU (CVE-2016-3426, CVE-2016-3427)
There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed in the Oracle April 2016 Critical Patch Update, plus four additional vulnerabilities. These may affect some configurations of IBM WebSphere Application Server Full Profile, IBM WebSphere Application Server Liberty Profile, and IBM WebSphere Application Server Hypervisor Edition.
CVE(s): CVE-2016-3427, CVE-2016-3426
Affected product(s) and affected version(s):
IBM Java SDK shipped with IBM WebSphere Application Server Version 8.5.0.0 through 8.5.5.9.
- This does not occur on IBM Java SDK shipped with WebSphere Application Servers Fix Packs 8.5.5.10
Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/23NlT3J
X-Force Database: http://ift.tt/1N2N48r
X-Force Database: http://ift.tt/1N2N2xe
from IBM Product Security Incident Response Team http://ift.tt/24VT8b1