IBM PureApplication System Version 2.2.2.2

Download Description

To download the interim fix, go to the PureApplication System product page on Fix Central.

Version 2.2.2.2 includes fixes for these security vulnerabilities:

CVEID: CVE-2016-6302
DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the failure to consider the HMAC size during validation of the ticket length by the tlsdecrypt_ticket function A remote attacker could exploit this vulnerability using a ticket that is too short to cause a denial of service.

CVEID: CVE-2016-6304
DESCRIPTION: OpenSSL is vulnerable to a denial of service. By repeatedly requesting renegotiation, a remote authenticated attacker could send an overly large OCSP Status Request extension to consume all available memory resources.

CVEID: CVE-2016-2177
DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the incorrect use of pointer arithmetic for heap-buffer boundary checks. By leveraging unexpected malloc behavior, a remote attacker could exploit this vulnerability to trigger an integer overflow and cause the application to crash.

CVEID: CVE-2016-2178
DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DSA implementation that allows the following of a non-constant time codepath for certain operations. An attacker could exploit this vulnerability using a cache-timing attack to recover the private DSA key.

CVEID: CVE-2016-3485
DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the Networking component has no confidentiality impact, low integrity impact, and no availability impact.

CVEID: CVE-2016-5573
DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the Hotspot component has high confidentiality impact, high integrity impact, and high availability impact.

CVEID: CVE-2016-5542
DESCRIPTION: An unspecified vulnerability related to the Libraries component has no confidentiality impact, low integrity impact, and no availability impact.

CVEID: CVE-2016-5597
DESCRIPTION: An unspecified vulnerability related to the Networking component could allow a remote attacker to obtain sensitive information resulting in a high confidentiality impact using unknown attack vectors.

CVEID: CVE-2016-5387
DESCRIPTION: Apache HTTP Server could allow a remote attacker to redirect HTTP traffic of CGI application, caused by the failure to protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable. By using a specially-crafted Proxy header in a HTTP request, an attacker could exploit this vulnerability to redirect outbound HTTP traffic to arbitrary proxy server. This is also known as the "HTTPOXY" vulnerability.


See the following known limitations:

A warning event is generated when a user attempts to create a collection set on the system.

If an integrated pattern or component is not listed, there were no fixes for that pattern or component in this version.