Description:

TIBCO Spotfire Web Player vulnerabilities
  Original release date: November 12, 2014
  Last revised: --
  Source: TIBCO Software Inc.

Systems Affected

  TIBCO Spotfire Web Player 6.0.0 and 6.0.1
  TIBCO Spotfire Web Player 6.5.0 and 6.5.1
  TIBCO Spotfire Deployment Kit 6.0.0 and 6.0.1
  TIBCO Spotfire Deployment Kit 6.5.0 and 6.5.1
  TIBCO Silver Fabric Enabler for Spotfire Web Player 1.6.0

  The following components are affected:

    *  TIBCO Spotfire Web Player Engine


Description

  The TIBCO Spotfire components listed above contain a critical vulnerability
  which could allow information disclosure.

  TIBCO has released updated versions of the affected software products
  which address these issues.  TIBCO strongly recommends sites running the
  affected components install the applicable update as described below.


Impact

  The impact of this vulnerability may include unprivileged information disclosure.

  CVSS v2 Base Score: 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N)


Solution

  For each affected system, update to the corresponding software versions:

  TIBCO Spotfire Web Player 6.0.X version 6.0.2 or higher
  TIBCO Spotfire Web Player 6.5.X version 6.5.2 or higher
  TIBCO Spotfire Deployment Kit 6.0.X version 6.0.2 or higher
  TIBCO Spotfire Deployment Kit 6.5.X version 6.5.2 or higher
  TIBCO Silver Fabric Enabler for Spotfire Web Player version 1.6.1 or higher


References

  http://www.tibco.com/mk/advisory.jsp
  CVE: CVE-2014-7195