IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.
Under certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0) allows untrusted code running under a security manager to elevate its privileges.
External References:
https://exchange.xforce.ibmcloud.com/vulnerabilities/138823
An information leak flaw was found in the IBM JDK Java Security Components. Upstream security bulletin describes the issue as:
IBM Java Security Components could allow an attacker with physical access to the system to obtain sensitive information from the Kerberos Credential Cache.
References:
http://www-01.ibm.com/support/docview.wss?uid=swg21969225 http://www.ibm.com/developerworks/java/jdk/alerts/#IBMSecurityUpdateNovember2015
IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16 FP7, and 5.0 before SR16 FP13 stores plaintext information in memory dumps, which allows local users to obtain sensitive information by reading a file.
Adam Gowdiak (Security Explorations) reported that the fix for IBM JDK issue CVE-2013-5456 (bug 1027748), also known as "Issue 70", did not correctly address the problem. Applied fix only restricted access to the vulnerable package, rather then addressing the underlying problem of running untrusted code inside doPrivileged block.
Report:
http://seclists.org/fulldisclosure/2016/Apr/43
Write-up of the issue:
http://www.security-explorations.com/materials/SE-2012-01-IBM-5.pdf
Proof-of-concept code:
http://www.security-explorations.com/materials/se-2012-01-70.2.zip
It was reported that the IBM fix for the issue 67 from this document http://www.security-explorations.com/materials/SE-2012-01-IBM-2.pdf didn't address the problem properly.
References:
http://seclists.org/fulldisclosure/2016/Apr/3
Full report:
http://www.security-explorations.com/materials/SE-2012-01-IBM-4.pdf
A buffer overflow flaw was fixed in IBM JDK 6 SR16-FP25, 7 SR9-FP40, 7R1 SR3-FP40, and 8 SR3:
CVEID: CVE-2016-0264 DESCRIPTION: A buffer overflow vulnerability in the IBM JVM facilitates arbitrary code execution under certain limited circumstances. CVSS Base Score: 5.6 CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
http://www-01.ibm.com/support/docview.wss?uid=swg21980826
External Reference:
http://www.ibm.com/developerworks/java/jdk/alerts/#IBMSecurityUpdateApril2016