IBM Security Updates July 2013

IBM have released their software update (Synchronized Security Release, SSR) for July. Updates fix eight vulnerabilities in IBM Java Runtime Environment (JRE).

Affected versions:
- IBM Java JRE 1.4.2 prior version 1.4.2 SR13-FP18
- IBM Java JRE 5.0 prior version 5.0.0 SR16-FP3
- IBM Java JRE 6 prior versions 6.0.0 SR14 and 6.0.1 SR6
- IBM Java JRE 7 prior version 7.0.0 SR5

More information in the related alert

Vulnerabilities Affecting IBM Lotus Notes

There have been found buffer overflow vulnerabilities in IBM Lotus Notes for Windows. The vulnerabilities could allow an attacker to execute arbitrary code in target system. To exploit the vulnerabilities user can be lured to open specially crafted file attachment.

Affected software:
IBM Lotus Notes 8.5.2
IBM Lotus Notes 8.5.1
IBM Lotus Notes 8.0.x
IBM Lotus Notes 7.x
IBM Lotus Notes 6.x
IBM Lotus Notes 5.x

At the moment there's a patch available for version 8.5.2 only. Users of other affected versions are advised to turn vulnerable feature off until the fix is available. More information about workarounds here.

Vulnerabilities In Lotus Notes File Viewers

IBM has released an update for Lotus Notes email client. The update fixes vulnerabilities that are related to way how Notes handles file attachments. By exploiting these vulnerabilities it may be possible to execute arbitrary code in vulnerable system.

Affected versions are:
- Lotus Notes 8.5 series prior version 8.5.1 Fix Pack 4
- Lotus Notes 8.0 series prior version 8.0.2 Fix Pack 6
- Lotus Notes 7 series
- Lotus Notes 6.5 series
- Lotus Notes 5 series

Solution:
IBM recommends to install Lotus Notes 8.0.2 Fix Pack 6 or Lotus Notes 8.5.1 Fix Pack 4. If that's not possible then workarounds can be used. More about these and other details can be read from related support document.