IT48716: IBM SPECTRUM CONTROL SECURITY APAR FOR CVE-2025-50106,CVE-2025-30761, CVE-2025-30754, CVE-2025-30749

IBM Spectrum Control 5.4.13.2 - Agents
IBM Spectrum Control 5.4.13.2 - Windows Server
IBM Spectrum Control 5.4.13.2 - Linux Server
IBM Spectrum Control 5.4.13.2 - AIX Server

APAR status

• Closed as program error.

Error description

• CVE ID: CVE-2025-50106
  Description:
  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
  Oracle GraalVM Enterprise Edition product of Oracle Java SE
  (component: 2D).  Difficult to exploit vulnerability allows
  unauthenticated attacker with network access via multiple
  protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,
  Oracle GraalVM Enterprise Edition.  Successful attacks of this
  vulnerability can result in takeover of Oracle Java SE, Oracle
  GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This
  vulnerability can be exploited by using APIs in the specified
  Component, e.g., through a web service which supplies data to
  the APIs. This vulnerability also applies to Java deployments,
  typically in clients running sandboxed Java Web Start
  applications or sandboxed Java applets, that load and run
  untrusted code (e.g., code that comes from the internet) and
  rely on the Java sandbox for security.
  
  CVE ID: CVE-2025-30761
  Description:
  Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise
  Edition product of Oracle Java SE (component: Scripting).
  Difficult to exploit vulnerability allows unauthenticated
  attacker with network access via multiple protocols to
  compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.
  Successful attacks of this vulnerability can result in
  unauthorized creation, deletion or modification access to
  critical data or all Oracle Java SE, Oracle GraalVM Enterprise
  Edition accessible data. Note: This vulnerability can be
  exploited by using APIs in the specified Component, e.g.,
  through a web service which supplies data to the APIs. This
  vulnerability also applies to Java deployments, typically in
  clients running sandboxed Java Web Start applications or
  sandboxed Java applets, that load and run untrusted code (e.g.,
  code that comes from the internet) and rely on the Java sandbox
  for security.
  
  CVE ID: CVE-2025-30754
  Description:
  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
  Oracle GraalVM Enterprise Edition product of Oracle Java SE
  (component: JSSE). Difficult to exploit vulnerability allows
  unauthenticated attacker with network access via TLS to
  compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle
  GraalVM Enterprise Edition. Successful attacks of this
  vulnerability can result in  unauthorized update, insert or
  delete access to some of Oracle Java SE, Oracle GraalVM for JDK,
  Oracle GraalVM Enterprise Edition accessible data as well as
  unauthorized read access to a subset of Oracle Java SE, Oracle
  GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible
  data. Note: This vulnerability applies to Java deployments,
  typically in clients running sandboxed Java Web Start
  applications or sandboxed Java applets, that load and run
  untrusted code (e.g., code that comes from the internet) and
  rely on the Java sandbox for security. This vulnerability does
  not apply to Java deployments, typically in servers, that load
  and run only trusted code (e.g., code installed by an
  administrator).
  
  
  CVE ID: CVE-2025-30749
  Description:
  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK,
  Oracle GraalVM Enterprise Edition product of Oracle Java SE
  (component: 2D).  Supported versions that are affected are
  Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7,
  24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and  24.0.1;
  Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit
  vulnerability allows unauthenticated attacker with network
  access via multiple protocols to compromise Oracle Java SE,
  Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
  Successful attacks of this vulnerability can result in takeover
  of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM
  Enterprise Edition. Note: This vulnerability applies to Java
  deployments, typically in clients running sandboxed Java Web
  Start applications or sandboxed Java applets, that load and run
  untrusted code (e.g., code that comes from the internet) and
  rely on the Java sandbox for security. This vulnerability does
  not apply to Java deployments, typically in servers, that load
  and run only trusted code (e.g., code installed by an
  administrator).
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Control 5.4.0 - 5.4.13.1 users                  *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * SECURITY APAR FOR:                                           *
  * CVE-2025-50106, CVE-2025-30761,                              *
  * CVE-2025-30754, CVE-2025-30749                               *
  *                                                              *
  * See security bulletin for details of the vulnerabilities:    *
  * https://www.ibm.com/support/pages/node/7252597               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fix maintenance.                                       *
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is contained in the following release:
  
  IBM Spectrum Control 5.4.13.2   [ 5.4.13.2-IBM-SC ]
  
  https://www.ibm.com/support/pages/node/359939
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TPC ADVANCED

• Fixed component ID

  5608TPCA0

Applicable component levels