先日公表された “GHOST” セキュリティ脆弱性において glibc ライブラリにセキュリティ上の危険が存在することが明らかになりました。

The SSL 3.0 vulnerability documented recently in Reference: CVE-2014-3566 was expanded on December 8, 2014 to identify some implementations of TLS as being vulnerable too (CVE-2014-8730).

InterSystems has discovered and corrected a defect in our web application technology used by the HealthShare portal and the Clinical Viewer. In rare circumstances, this defect can result in sharing of data by separate user sessions. This could lead to (a) a user having a different set of privileges and being able to access patient records they are not permitted to view or (b) being presented with clinical data from a different patient in the Clinical Viewer.

InterSystems has discovered and corrected a defect that can result in CSP session IDs being shared by two users. More specifically, there are situations where a new user for an application will be allocated a CSP session ID that has already been allocated to, and in use by, another user. The impact of this defect is application-dependent, but one possible consequence is the incorrect display of application data belonging to the session of another user.

In response to the recently documented SSL 3.0 vulnerability (Reference: CVE-2014-3566), InterSystems advises customers to switch from using or requiring SSL 2.0 or SSL 3.0 and instead use only TLSv1.

InterSystems has corrected a defect that can impact data integrity. The defect is present in Caché, Ensemble, and HealthShare version 2013.1.0 and later.

The OpenSSL Project http://www.openssl.org recently released a security advisory on vulnerabilities in the OpenSSL product.

InterSystems has corrected a defect that can lead to $BIT operations over ECP being rolled back incorrectly.

InterSystems has corrected a defect that causes incorrect calculation on Itanium platforms. The defect is present in InterSystems assembly optimizations targeted to Itanium platforms.

InterSystems has corrected several defects that can only occur in rare circumstances but can impact data integrity.